{
  "type": "URL",
  "indicator": "https://vcards.hallrender.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://vcards.hallrender.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3807973132,
      "indicator": "https://vcards.hallrender.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 50,
      "pulses": [
        {
          "id": "69d68fffbf012630d57033b6",
          "name": "Sabey SWIPPER - Pornhub\u00bbX.Com migration to Twitter | Sabey\u2019s Daddy Data Center ",
          "description": "",
          "modified": "2026-04-08T17:27:27.851000",
          "created": "2026-04-08T17:27:27.851000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69bea426487bffa5384c6f38",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "11 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf8e2663d5480917ddb699",
          "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender [i cloned OctoSeek] T8",
          "description": "",
          "modified": "2026-03-22T08:35:26.266000",
          "created": "2026-03-22T06:37:26.233000",
          "tags": [
            "united",
            "as393601 state",
            "a domains",
            "passive dns",
            "as397241",
            "certificate",
            "urls",
            "search",
            "showing",
            "entries",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "info",
            "record type",
            "ttl value",
            "all txt",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "resolutions",
            "historical ssl",
            "communicating",
            "problems",
            "parent domain",
            "njrat",
            "ransomware",
            "startpage",
            "historical",
            "malware",
            "execution",
            "threat roundup",
            "april",
            "september",
            "remcos rat",
            "august",
            "june",
            "qakbot",
            "push",
            "service",
            "privateloader",
            "amadey",
            "powershell",
            "qbot",
            "cobalt strike",
            "core",
            "hacktool",
            "november",
            "october",
            "roundup",
            "threat network",
            "cellbrite",
            "february",
            "emotet",
            "maze",
            "metro",
            "dark",
            "malicious",
            "team",
            "critical",
            "copy",
            "awful",
            "parallax rat",
            "banker",
            "keylogger",
            "dns replication",
            "date",
            "csc corporate",
            "domains",
            "code",
            "server",
            "registrar abuse",
            "registrar iana",
            "registry domain",
            "registrar url",
            "registrar",
            "contact phone",
            "apple ios",
            "quasar",
            "remcos",
            "ursnif",
            "chaos",
            "ransomexx",
            "azorult",
            "agent tesla",
            "evilnum",
            "asyncrat",
            "win32 exe",
            "wininit",
            "beta version",
            "cmstp",
            "taskscheduler",
            "ieudinit",
            "nat32",
            "certsentry",
            "type name",
            "wc3 rpg",
            "pegasus",
            "unknown",
            "domain",
            "servers",
            "germany unknown",
            "name servers",
            "status",
            "next",
            "as29066 host",
            "as133618",
            "cname",
            "as47846",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "encrypt",
            "china unknown",
            "as38365 beijing",
            "as134175 unit",
            "707713",
            "hong kong",
            "virgin islands",
            "as6461 zayo",
            "ransom",
            "exploit",
            "ipv4",
            "pulse submit",
            "url analysis",
            "trojan",
            "body",
            "click",
            "creation date",
            "emails",
            "expiration date",
            "domain privacy",
            "hostname",
            "dynamicloader",
            "state",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "show",
            "slcc2",
            "media center",
            "error",
            "delphi",
            "guard",
            "write",
            "win32",
            "target",
            "redir",
            "facebook",
            "dcom",
            "local",
            "delete",
            "utf8",
            "unicode text",
            "crlf line",
            "rgba",
            "yara detections",
            "default",
            "asnone",
            "get na",
            "dns lookup",
            "probe ms17010",
            "eternalblue",
            "playgame",
            "high",
            "related pulses",
            "yara rule",
            "anomalous file",
            "dynamic",
            "malware infection",
            "cnc",
            "procmem_yara",
            "antivm_generic_disk",
            "modify_proxy infostealer_cookies",
            "network_http",
            "anomalous_deletefile",
            "antidebug_guardpages",
            "powershell_request",
            "powershell_download",
            "as63949 linode",
            "mtb feb",
            "open ports",
            "backdoor",
            "gmt content",
            "trojandropper",
            "simda",
            "lockbit",
            "win.trojan",
            "midia-4",
            "floxif",
            "cryptowall",
            "brontok",
            "check in",
            "record value",
            "files",
            "location united",
            "america asn",
            "as16509",
            "download",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls http",
            "samples",
            "tsara brashears",
            "2nd corintnthians 4:8-9",
            "injection_inter_process",
            "injection_create_remote_thread",
            "persistence_autorun",
            "bypass_firewall",
            "disables_windowsupdate",
            "dynamic_function_loading",
            "http_request",
            "query",
            "delete c",
            "activity dns",
            "components",
            "file execution",
            "observed dns",
            "as4837 china",
            "nxdomain",
            "a nxdomain",
            "wannacry",
            "missouri",
            "safebae",
            "hallrender",
            "house.mo.gov",
            "typosquatting",
            "tactics",
            "google",
            "win64",
            "khtml",
            "gecko",
            "veryhigh",
            "aes256gcm",
            "dalles",
            "cookie",
            "urls https",
            "xpcegvo2adsnq",
            "mhkz",
            "mvi2",
            "keepaliveyes",
            "fexp24007246",
            "nsyt",
            "eva reimer",
            "daisy coleman",
            "brian sabey",
            "https://lawlink.com/documents/10935/blackbag-technologies-announ"
          ],
          "references": [
            "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
            "dns.msftncsi.com",
            "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
            "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "23.216.147.64",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
            "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
            "alohatube.xyz [BotNetwork]",
            "facebooksunglassshop.com",
            "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
            "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
            "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
            "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
            "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
            "remote.utorrent.com [remote router logins]",
            "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
            "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
            "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
            "http://tvm77.fashiongup.in/tracking/track-open",
            "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
            "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
            "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
            "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
            "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
            "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
            "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
            "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
            "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
            "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
            "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
            "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
            "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
            "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
            "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "China",
            "Australia",
            "Hong Kong"
          ],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "AsyncRAT",
              "display_name": "AsyncRAT",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Chaos",
              "display_name": "Chaos",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "EVILNUM",
              "display_name": "EVILNUM",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Keylogger",
              "display_name": "Keylogger",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "Parallax RAT",
              "display_name": "Parallax RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Remcos RAT",
              "display_name": "Remcos RAT",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-336074",
              "display_name": "Win.Trojan.Agent-336074",
              "target": null
            },
            {
              "id": "Arid.Viper_CnC",
              "display_name": "Arid.Viper_CnC",
              "target": null
            },
            {
              "id": "WininiCrypt",
              "display_name": "WininiCrypt",
              "target": null
            },
            {
              "id": "PWS:Win32/QQpass.CI",
              "display_name": "PWS:Win32/QQpass.CI",
              "target": "/malware/PWS:Win32/QQpass.CI"
            },
            {
              "id": "Win.Trojan.Midia-4",
              "display_name": "Win.Trojan.Midia-4",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Win32/SocStealer!rfn",
              "display_name": "Win32/SocStealer!rfn",
              "target": null
            },
            {
              "id": "Backdoor.Win32.Shiz.ufj",
              "display_name": "Backdoor.Win32.Shiz.ufj",
              "target": null
            },
            {
              "id": "Email-Worm.Win32.Brontok.n",
              "display_name": "Email-Worm.Win32.Brontok.n",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65c91f2b7c03b480379ae4d1",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2668,
            "FileHash-SHA1": 2469,
            "FileHash-SHA256": 8054,
            "URL": 6185,
            "domain": 2421,
            "hostname": 3042,
            "CVE": 5,
            "email": 15,
            "CIDR": 1,
            "IPv4": 18
          },
          "indicator_count": 24878,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "28 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bea426487bffa5384c6f38",
          "name": " Brian Sabey illegally deleting IoC\u2019s | SWIPPER - Pornhub\u00bbX.Com migration to Twitter Sabey Erasing",
          "description": "",
          "modified": "2026-03-21T13:59:02.016000",
          "created": "2026-03-21T13:59:02.016000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "29 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6872f4c510c590b7cdc5ff6a",
          "name": "Crowdsourced Collection of PayPal Mafia Monster - Foundry\u2019s Palantair",
          "description": "Americans are investing in what Edward Snowden foretold of\u2026 your future from beginning to end will  predict how you will be treated. Preemptively policing people even if you have to make up a past.. |\n\nThe New York Times\nMay 30, 2025 \u2014 The Trump administration has expanded Palantir's work with the government, spreading the company's technology \u2014 which could easily merge data on ...\nFormer Palantir workers condemn company's work with ...\n\nNPR\nMay 5, 2025 \u2014 Thirteen former employees of influential data-mining firm Palantir are condemning the company's work with the Trump administration.\nWyden AOC Palantir Letter 061725\n\nSenate Finance (.gov)\nJun 17, 2025 \u2014 The Trump Administration has spent taxpayer dollars on Palantir software at numerous other government agencies and paid it billions of dollars ...\n#foundry #rip #palantir #jeffreyreimerdpt #lawenforcement #twitter #tsarabrashearsblessed #apple #privacynow #fightforprivacy #sabey #hallrender",
          "modified": "2025-08-11T23:02:24.583000",
          "created": "2025-07-12T23:50:29.847000",
          "tags": [
            "url https",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "entries",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "enter source",
            "urior exirag",
            "diri type",
            "data upload",
            "extraction",
            "failed",
            "included iocs",
            "review iocs",
            "find sugge",
            "extr extract",
            "in data",
            "extract",
            "type",
            "u extractio",
            "extra",
            "review ic",
            "ipv4",
            "pulses hostname",
            "accountunlock",
            "united",
            "ireland",
            "canada",
            "brazil",
            "sweden",
            "australia",
            "search",
            "scan",
            "iocs",
            "learn more",
            "filehashsha1",
            "filehashmd5",
            "types of",
            "extra data",
            "included review",
            "china",
            "colombia",
            "filepath https",
            "enter sc",
            "extr data",
            "include review",
            "exclude sugges",
            "filehashsha256",
            "hostname",
            "dicators japan",
            "url tor",
            "extrac data",
            "ic excluded",
            "suggeste",
            "stop",
            "type no",
            "no entrie",
            "included",
            "review locc",
            "excluded data",
            "sc data",
            "extri data",
            "includec review",
            "exclude data",
            "suggested",
            "se extra",
            "suggest",
            "manaiv add",
            "indicator",
            "review lace",
            "extri",
            "find s",
            "typ no",
            "no entdi",
            "ous u",
            "dron aew",
            "avtrat",
            "extre data",
            "manually",
            "add indicator",
            "pulses url",
            "url url",
            "typ host",
            "host url",
            "include",
            "z6911541",
            "extraction fail",
            "enter souf",
            "s type",
            "ur extraction",
            "extraction data",
            "jul all",
            "pulse data",
            "report external",
            "review",
            "extre please",
            "se extraction",
            "report spam",
            "all t8",
            "firmip",
            "bofa",
            "wikileaks",
            "tmobile",
            "dish",
            "capture",
            "cookie",
            "enter s",
            "please sub",
            "include outroov",
            "excludel sugges",
            "extra please",
            "high priority",
            "alerts ids",
            "priority alerts",
            "cnc beacon",
            "winver",
            "digitalmistica",
            "november",
            "pulse",
            "palantir",
            "foundry twitter",
            "arkei stealer",
            "config",
            "install",
            "downloader",
            "cidr",
            "domain",
            "indicators hong",
            "kong",
            "ukraine",
            "status no",
            "object",
            "unruy",
            "http",
            "remote",
            "keylogger",
            "foundry created",
            "days ago",
            "white keylogger",
            "apple",
            "foundry tech",
            "mafia",
            "t1045",
            "packing",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1457",
            "showing",
            "types",
            "indicators show",
            "dicator role",
            "tsara brashears",
            "tsara",
            "porn",
            "porn videos",
            "pornhub https",
            "searchtsar",
            "watch tsara",
            "most relevant",
            "open threat",
            "green",
            "love",
            "daily",
            "videos",
            "free porn",
            "hybrid analysis",
            "falcon sandbox",
            "top tsara",
            "brashears porn",
            "stream",
            "spice",
            "download",
            "hybrid",
            "njrat",
            "threat network",
            "https",
            "created",
            "years ago",
            "modified",
            "months ago",
            "tinynote",
            "douglas county",
            "co sheriff",
            "office",
            "pegasus attacks",
            "sa victim",
            "octoseek public",
            "white",
            "excludedocs",
            "sugges",
            "stop data",
            "tsara lynn",
            "brashears les",
            "lynn brashears",
            "translate",
            "pornhub page",
            "emotet",
            "se review",
            "typ url",
            "dom hos",
            "hostname data",
            "harmful",
            "octoseekpulse",
            "attacks sa",
            "bandit stealer",
            "flubot",
            "agent tesla",
            "qbot",
            "qakbot",
            "ursnif",
            "azorult",
            "djvu",
            "hacktool",
            "maze",
            "dark",
            "linux",
            "android10",
            "khtml",
            "costcpc",
            "userosandroid",
            "bannerid2738231",
            "india",
            "enter so",
            "please subr",
            "suggest data",
            "netherlands",
            "russia",
            "america malware",
            "families",
            "sc type",
            "please",
            "show",
            "url data",
            "fanec",
            "include failed",
            "review exclude",
            "extre",
            "includea",
            "exclude toosrou",
            "sugges data",
            "typ data",
            "information",
            "cobalt strike",
            "ransomexx",
            "quackbot",
            "comspec",
            "span",
            "idn1",
            "sendimage0",
            "refts0",
            "include data",
            "uny inuuue",
            "fileh fileh",
            "exclude suggest",
            "uniy",
            "type fileh",
            "extr please",
            "ineluderc\u0660",
            "review data",
            "excludedlocs"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1065",
              "name": "Uncommonly Used Port",
              "display_name": "T1065 - Uncommonly Used Port"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 58,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12679,
            "domain": 1134,
            "hostname": 3543,
            "FileHash-MD5": 251,
            "email": 7,
            "FileHash-SHA256": 1927,
            "FileHash-SHA1": 232,
            "CVE": 1,
            "CIDR": 1,
            "URI": 1
          },
          "indicator_count": 19776,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "686ab98ff0cb9baa4e2b2000",
          "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied  OctoseekPulse)  Attacks SA victims?",
          "description": "",
          "modified": "2025-08-05T21:02:46.419000",
          "created": "2025-07-06T17:59:43.440000",
          "tags": [
            "runtime process",
            "localappdata",
            "size",
            "sha256",
            "sha1",
            "temp",
            "prefetch8",
            "prefetch1",
            "unicode text",
            "type data",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "mitre",
            "writes a pe file header to disc",
            "show process",
            "date",
            "document file",
            "v2 document",
            "ascii text",
            "malicious",
            "local",
            "path",
            "found",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "october",
            "resolutions",
            "apple ios",
            "referrer",
            "communicating",
            "execution",
            "june",
            "august",
            "emotet",
            "qakbot",
            "agent tesla",
            "azorult",
            "core",
            "maze",
            "metro",
            "dark",
            "team",
            "critical",
            "copy",
            "awful",
            "ursnif",
            "hacktool",
            "info",
            "qbot",
            "april",
            "njrat",
            "nokoyawa",
            "djvu",
            "flubot",
            "ransomware",
            "bandit stealer",
            "hallrender",
            "spyware",
            "safebae",
            "tsara brashears",
            "westlaw",
            "river.rocks",
            "brian sabey",
            "targeting",
            "dnspionage",
            "united",
            "unknown",
            "search",
            "aaaa",
            "showing",
            "domain",
            "creation date",
            "record value",
            "dnssec",
            "body",
            "passive dns",
            "encrypt",
            "as14061",
            "germany unknown",
            "as397240",
            "gmt server",
            "443 ma2592000",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "main",
            "installing",
            "as16276",
            "france unknown",
            "name servers",
            "as8075",
            "servers",
            "next",
            "as63949 linode",
            "as206834 team",
            "canada unknown",
            "status",
            "as61969 team",
            "msie",
            "chrome",
            "ransom",
            "gone",
            "title",
            "head body",
            "malware"
          ],
          "references": [
            "\u2193\u2192Found in: https://house.mo.gov/\u2193",
            "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
            "demo.auth.civicalg.com.sni.cloudflaressl.com",
            "happyrabbit.kr [Apple iOS threat]",
            "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
            "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
            "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
            "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
            "http://nudeteenporn.site"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Nokoyawa Ransomware",
              "display_name": "Nokoyawa Ransomware",
              "target": null
            },
            {
              "id": "Bandit Stealer",
              "display_name": "Bandit Stealer",
              "target": null
            },
            {
              "id": "FluBot",
              "display_name": "FluBot",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Djvu",
              "display_name": "Djvu",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1065",
              "name": "Uncommonly Used Port",
              "display_name": "T1065 - Uncommonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65c96df8fe0657d56a206a49",
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 251,
            "FileHash-SHA1": 211,
            "FileHash-SHA256": 3226,
            "domain": 1867,
            "URL": 10030,
            "hostname": 2919,
            "CVE": 7,
            "email": 6
          },
          "indicator_count": 18517,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "256 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68888ed9c3a537ac4491eba7",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration [scoreblue]",
          "description": "",
          "modified": "2025-07-29T09:05:29.205000",
          "created": "2025-07-29T09:05:29.205000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "264 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66804428b487338dc16f70a7",
          "name": "Brian Sabey Orbiting Tsara Brashears and associates | Espionage | Said client: Jeffrey Reimer",
          "description": "Brian Sabey & large team continue excessive orbiting target & family members in multiple states. \nUnwarranted, dangerous and illegal. \nLarge attacks have wreaked havoc on medical establishments, targets medical profile, once profitable business, legal manipulation, financial well being. forced poverty, swatting, imfostealer, insurance fraud, intellectual property use, Audi le spying, in person stalking, confrontations, great bodily harm, loss of peace, safety. basic human rights and privacy, phone call redirection, malvertising. In the name of assaulter Jeffrey Scott Reimer",
          "modified": "2024-11-05T10:00:12.606000",
          "created": "2024-06-29T17:28:08.283000",
          "tags": [
            "unknown",
            "united",
            "virgin islands",
            "as51852",
            "as33387",
            "as19905",
            "as44273 host",
            "cname",
            "nxdomain",
            "passive dns",
            "url http",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "entries",
            "urls",
            "files ip",
            "address domain",
            "ip related",
            "pulses otx",
            "pulses",
            "related tags",
            "indicator facts",
            "dga domain",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "pulse pulses",
            "ip address",
            "related nids",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "b59bn timestamp",
            "ff2c217402202b",
            "code",
            "false",
            "url https",
            "domain",
            "trojan",
            "hostname",
            "files",
            "body",
            "date",
            "path max",
            "age86400 set",
            "cookie",
            "script urls",
            "type",
            "mtb may",
            "script script",
            "trojanspy",
            "striven",
            "miles2",
            "rexxfield",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "date sat",
            "gmt server",
            "sakula malware",
            "historical ssl",
            "realteck audio",
            "lemon duck",
            "iocs",
            "tsara brashears",
            "loki password",
            "stealer",
            "windows",
            "auction",
            "metro",
            "core",
            "colibri loader",
            "hacktool",
            "status",
            "for privacy",
            "creation date",
            "record value",
            "name servers",
            "showing",
            "next",
            "mtb mar",
            "ipv4",
            "ransom",
            "west domains",
            "redacted for",
            "gmt location",
            "gmt max",
            "cowboy",
            "encrypt",
            "as60558 phoenix",
            "susp",
            "win32",
            "methodpost",
            "canada unknown",
            "as43350 nforce",
            "united kingdom",
            "as47846",
            "germany unknown",
            "briansabey",
            "body doubles",
            "orbiters",
            "malvertising",
            "cane",
            "get na",
            "show",
            "as16509",
            "delete c",
            "sinkhole cookie",
            "value snkz",
            "cape",
            "possible",
            "copy",
            "nivdort",
            "write",
            "bayrob",
            "malware",
            "exploit",
            "confirm https",
            "impact",
            "misc http",
            "cvss v2",
            "authentication",
            "n cvss",
            "v3 severity",
            "high attack",
            "emails",
            "cnc",
            "alphacrypt cnc",
            "beacon",
            "as15169 google",
            "limited",
            "as8560",
            "elite",
            "AS33387 nocix llc",
            "pegasus",
            "mercenary",
            "cellerebrand",
            "cellebrite",
            "apple",
            "dark",
            "apple ios",
            "ios",
            "apple iphone",
            "apple itunes",
            "itunes",
            "pegasystem",
            "data brokers",
            "hackers",
            "javascript",
            "please",
            "intel",
            "filehash",
            "av detections",
            "xorddos"
          ],
          "references": [
            "http://www.northpoleroute.com/78985064&type=0&resid=5312625",
            "espysite.azurewebsites.net - https://otx.alienvault.com/indicator/hostname/espysite.azurewebsites.net",
            "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
            "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256 aa289c89f2cdbfe896f4c77c611d94aa95858797014b57e24d5fe2bb0997d7b0",
            "Ransom:Win32/Haperlock.A: FileHash-MD5 46480bf46cde2b3e79852661cc5c36fc",
            "Ransom:Win32/Haperlock.A: FileHash-SHA1 c881d1434164b35fb16107a25f84995b7fdef37f",
            "Ransom:Win32/Haperlock.A; FileHash-SHA256 8264c73f129d4895573c2375ea4e4636b9d5df66852ce72ccc20d31a96ae7df1",
            "IDS Detections: W32/Bayrob Attempted Checkin 2 Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin",
            "IDS Detections: Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
            "Alerts: cape_detected_threat cape_extracted_content",
            "https://otx.alienvault.com/indicator/file/251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
            "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
            "\"Windows SMB Information Disclosure Vulnerability.\" - https://otx.alienvault.com/indicator/cve/CVE-2017-0147",
            "Backdoor:Win32/Fynloski.A: FileHash-SHA256 4e692806955f9ee3f4c7a5d9a1ac7729eb53b855b39e6f9f943f89ccba30bd49",
            "Backdoor:Win32/Fynloski.A: FileHash-SHA 453355033bb7977831ca87cc90156b594f13b2ee",
            "Backdoor:Win32/Fynloski.A: FileHash-MD5 c3113684e8f8aa6d1b1b67d59141e845",
            "TrojanClicker:Win32/Ellell.A: FileHash-SHA256 7456108771e6a8bac658276c1cb9e18c8c348fdd9cd3538419751c3b5ef3ac02",
            "TrojanClicker:Win32/Ellell.A: FileHash-SHA1 7a52b57df5b3c67f810a71dc39ff93688b141534",
            "TrojanClicker:Win32/Ellell.A: 4d3e7d486ec5918d91e54e51c4d07dc6",
            "PWS:Win32/Ymacco.AA50: FileHash-SHA256 105834163b1a0c89e12917a3145e14be6030a611e07f7f62fa7c57de838d6251",
            "PWS:Win32/Ymacco.AA50: FileHash-SHA1 57486d33246bce6dfedb0836cd97c9acd4a4a39a",
            "PWS:Win32/Ymacco.AA50: FileHash-MD5 5739cd62eb88e2a7e514784fe7cf5ca4",
            "https://otx.alienvault.com/indicator/ip/162.222.213.199",
            "TrojanDownloader:Win32/PurityScan.MI!MTB: FileHash-SHA1 58ba8715a88d883537ba8d0e20eea2a4d9269cad",
            "Ransom:Win32/Tescrypt: FileHash-SHA256 916e13eb1e4313b2a04a2ae21b4955b8228183b26709a64284098ca759a8f437",
            "PWS:Win32/QQpass.B!MTB: FileHash-SHA256 71fa9257f88c15b438616662dc468327199edb570286c7259d333953006b8eec",
            "PWS:Win32/QQpass.B!MTB: FileHash-SHA1 fec703ee7c02ffe35c6b987bb9aac3a765e95dfb",
            "PWS:Win32/QQpass.B!MTB: FileHash-MD5 f7c36b4e5b4b09dc369163377aade2d7",
            "Trojan:Win32/Zombie.A: FileHash-SHA256 0b87667251b79cb800ddd88bdabecea8e13248c426d4a14ae0aae0ef5783f943",
            "Trojan:Win32/Zombie.A: FileHash-SHA1 de974c697f0401d681e1bb3c8694a663e9e43d8f",
            "Trojan:Win32/Zombie.A: FileHash-MD5 34e85820b41c14e07dd564f22997e893",
            "Win.Virus.TeslaCrypt3-2: 78af1fd5be62ab829e49f9a1b5fbb8a9b30f8d0804cba5805c8f350b841d522e",
            "IDS Detections : W32/Bayrob Attempted Checkin 2 CryptoWall Check-in AlphaCrypt CnC Beacon 4 Trojan-Ransom.Win32.Blocker.avsx",
            "IDS Detections : AlphaCrypt CnC Beacon 3 MalDoc Request for Payload Aug 17 2016 Koobface W32/Bayrob Attempted Checkin",
            "IDS Detections : Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
            "https://otx.alienvault.com/indicator/ip/185.230.63.186",
            "CnC IP's: 192.187.111.221  63.141.242.43  63.141.242.44  63.141.242.46 81.17.18.195  81.17.18.197 81.17.29.146  81.17.29.148",
            "http://islamicsoftwares.com/downloads/iphone/audioCont/2/107.tar.gz http://islamicsoftwares.com/downloads/iphone/audioCont/7/110.tar.gz",
            "smartphonesonline.co.uk  https://smartphonesonline.co.uk/  https://www.smartphonesonline.co.uk/ [192.187.111.222. US - Request HTTP -Target IP]",
            "Mercenary Attackers / Cellebrite branded as: http://teacellertea.com/Pegasus/ NSO",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
            "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
            "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
            "https://otx.alienvault.com/indicator/ip/63.141.242.45",
            "Yara Detections: is__elf ,  xorddos ,  LinuxXorDDoS_VariantTwo",
            "Antivirus Detections: ELF:Xorddos-AE\\ [Trj] ,  Unix.Trojan.Xorddos-1 ,",
            "Trojan:Linux/Xorddos: FileHash-MD5 3b4ce1333614cd21c109054630e959b9",
            "Trojan:Linux/Xorddos:  FileHash-SHA1 a5780498e6fce5933a7e7bf59a6fa5742e97f559",
            "Trojan:Linux/Xorddos: FileHash-SHA256 0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
            "https://hallrender.com/attorney/brian-sabey"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort.CW",
              "display_name": "TrojanSpy:Win32/Nivdort.CW",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
            },
            {
              "id": "Ransom:Win32/Haperlock.A",
              "display_name": "Ransom:Win32/Haperlock.A",
              "target": "/malware/Ransom:Win32/Haperlock.A"
            },
            {
              "id": "Backdoor:Win32/Fynloski.A",
              "display_name": "Backdoor:Win32/Fynloski.A",
              "target": "/malware/Backdoor:Win32/Fynloski.A"
            },
            {
              "id": "TrojanClicker:Win32/Ellell.A",
              "display_name": "TrojanClicker:Win32/Ellell.A",
              "target": "/malware/TrojanClicker:Win32/Ellell.A"
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Win.Virus.TeslaCrypt3-2/Custom",
              "display_name": "Win.Virus.TeslaCrypt3-2/Custom",
              "target": null
            },
            {
              "id": "PWS:Win32/Ymacco.AA50",
              "display_name": "PWS:Win32/Ymacco.AA50",
              "target": "/malware/PWS:Win32/Ymacco.AA50"
            },
            {
              "id": "Ransom:Win32/Tescrypt",
              "display_name": "Ransom:Win32/Tescrypt",
              "target": "/malware/Ransom:Win32/Tescrypt"
            },
            {
              "id": "PWS:Win32/QQpass.B!MTB",
              "display_name": "PWS:Win32/QQpass.B!MTB",
              "target": "/malware/PWS:Win32/QQpass.B!MTB"
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan:Linux/Xorddos",
              "display_name": "Trojan:Linux/Xorddos",
              "target": "/malware/Trojan:Linux/Xorddos"
            },
            {
              "id": "Sakula RAT",
              "display_name": "Sakula RAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 106,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3885,
            "hostname": 1651,
            "URL": 5981,
            "FileHash-MD5": 486,
            "FileHash-SHA256": 3859,
            "SSLCertFingerprint": 2,
            "FileHash-SHA1": 487,
            "CVE": 7,
            "email": 8
          },
          "indicator_count": 16366,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "530 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f351ce26a103377d8eb5fa",
          "name": "Sex Tokens | Injection \u00bb Porn dumping - Cyber Folks .PL | Spectrum",
          "description": "Porn dumping into targeted devices after great effort. \nHall Render has always been a Malware Hosting website.\nDrive by compromise,    \nPorn Storm compilation.\n\nhttps://api.dotz.com.br/accounts/api/default/externallogin/login",
          "modified": "2024-10-24T22:01:13.406000",
          "created": "2024-09-24T23:57:02.111000",
          "tags": [
            "url https",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "porn type",
            "showing",
            "entries",
            "tsara type",
            "pulses url",
            "adware backdoor",
            "email document",
            "exploit domain",
            "owner exploit",
            "kit exploit",
            "source file",
            "hacking tools",
            "hunting macro",
            "malware hosting",
            "memory scanning",
            "wild fantasy",
            "world",
            "download",
            "xxx video",
            "xxx sex",
            "desi",
            "tamil",
            "videos xxx",
            "hd posts",
            "photos pics",
            "https",
            "indicator role",
            "title added",
            "active related",
            "unknown",
            "united",
            "for privacy",
            "nxdomain",
            "meta",
            "internet gmbh",
            "creation date",
            "date",
            "audio",
            "clear hindi",
            "bhabi sex",
            "bedroom indian",
            "fakaid",
            "ww3008",
            "fingering her",
            "young boy",
            "sexy",
            "next",
            "witch",
            "filehashmd5",
            "ipv4",
            "months ago",
            "information",
            "scan endpoints",
            "all scoreblue",
            "report spam",
            "created",
            "modified",
            "zbot",
            "keyword",
            "latina",
            "teen sex",
            "jeffrey reimer",
            "reimer dpt",
            "jeff reimer sex",
            "reimer type",
            "hostname",
            "domain",
            "copyright",
            "remote",
            "t1003",
            "os credential",
            "dumping",
            "t1012",
            "t1036",
            "t1071",
            "protocol",
            "t1082",
            "as8075",
            "aaaa",
            "as30148 sucuri",
            "certificate",
            "record value",
            "body",
            "status",
            "passive dns",
            "urls",
            "hallrender",
            "brian sabey",
            "sabey xxx",
            "drive by compromise",
            "cobalt strike",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "china flag",
            "china domain",
            "files related",
            "pulses none",
            "files domain",
            "analyzer paste",
            "iocs",
            "hostnames",
            "urls https",
            "china unknown",
            "as4837 china",
            "redacted for",
            "a domains",
            "cname",
            "jeffrey reimer pt",
            "sucuri website",
            "span td",
            "time",
            "firewall",
            "win64",
            "back",
            "xtra",
            "name servers",
            "files",
            "tls web",
            "log id",
            "gmtn",
            "false",
            "ocsp",
            "ca issuers",
            "phucket news",
            "hacking",
            "registrar abuse",
            "gateway protocol abuse",
            "swipper relationship"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1428",
              "name": "Exploit Enterprise Resources",
              "display_name": "T1428 - Exploit Enterprise Resources"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1599,
            "hostname": 2988,
            "URL": 8561,
            "FileHash-SHA256": 1207,
            "email": 41,
            "FileHash-MD5": 126,
            "FileHash-SHA1": 36,
            "CVE": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 14561,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "541 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb1585832bcf4f494f0335",
          "name": "Telco - Swipper | Emotet and other malware spreader. BGP Bridging",
          "description": "",
          "modified": "2024-10-20T13:04:44.866000",
          "created": "2024-09-18T18:01:41.013000",
          "tags": [
            "net152",
            "net1520000",
            "loudoun county",
            "ans core",
            "nethandle",
            "as1321",
            "parkway city",
            "as701 orgnocref",
            "swipper",
            "verizon",
            "high",
            "intel",
            "icmp traffic",
            "dns query",
            "object",
            "all scoreblue",
            "filehash",
            "malware",
            "comcast",
            "cve1102",
            "actors",
            "investigation",
            "bad domains",
            "emotet am",
            "iocs",
            "first",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "webcc",
            "gmo internet",
            "csc corporate",
            "domains",
            "alibaba cloud",
            "computing",
            "beijing",
            "dynadot",
            "ltd dba",
            "china telecom",
            "group",
            "google",
            "cloudflarenet",
            "kb txtresse",
            "mb smartsaver",
            "admin cmd",
            "mb threatsniper",
            "mb history",
            "mb gadget",
            "installer",
            "referrer",
            "styes worm",
            "historical ssl",
            "script script",
            "i span",
            "ie script",
            "win64",
            "span",
            "urls",
            "levelblue labs",
            "pulses",
            "nastya",
            "meta",
            "open",
            "date",
            "vj92",
            "uagdaaeqcqaaaag",
            "ukgbagaqcqaaaae",
            "slfrd1",
            "hostnames",
            "urls http",
            "ukgbagaqcq",
            "jid1886833764",
            "jid882556742",
            "samples",
            "unknown",
            "united",
            "as20940",
            "as2914 ntt",
            "nxdomain",
            "status",
            "as6461 zayo",
            "united kingdom",
            "as15169 google",
            "as33438",
            "search",
            "creation date",
            "name servers",
            "showing",
            "hungary unknown",
            "entries",
            "scan endpoints",
            "next",
            "cape",
            "show",
            "copy",
            "emotet malware",
            "read",
            "write",
            "delete",
            "june",
            "emotet",
            "as14627",
            "passive dns",
            "ipv4",
            "pulse pulses",
            "win32",
            "months ago",
            "created",
            "modified",
            "email",
            "glupteba",
            "hostname",
            "cyber",
            "read c",
            "port",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dock",
            "execution",
            "method status",
            "url hostname",
            "ip country",
            "type get",
            "cachecontrol",
            "location https",
            "date thu",
            "gmt server",
            "code",
            "ve234 server",
            "aaaa",
            "whitelisted",
            "as44273 host",
            "as46691",
            "domain",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "trojan",
            "body"
          ],
          "references": [
            "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
            "Antivirus Detections: Other:Malware-gen\\ [Trj]",
            "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
            "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
            "Yara Detections: osx_GoLang",
            ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
            "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
            "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
            "http://appleidi-iforgot.3utilities.com/Verify.php",
            "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
            "152.199.171.19 : USDA Fort Collins, Colorado",
            "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
            "152.199.161.19: ANS Communications, Inc (ANS)",
            "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
            "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
            "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
            "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
            "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
            "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
            "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "SLF:Trojan:Win32/Grandoreiro.A",
              "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Emotet-9951800-0",
              "display_name": "Win.Trojan.Emotet-9951800-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ca37ac60cb425a2b3856c6",
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "URL": 4635,
            "domain": 771,
            "email": 11,
            "hostname": 1993,
            "FileHash-SHA256": 3185,
            "FileHash-MD5": 113,
            "FileHash-SHA1": 101,
            "CVE": 3
          },
          "indicator_count": 10814,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "546 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d4916fa7338286448118a1",
          "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com migration to Twitter ",
          "description": "",
          "modified": "2024-10-19T18:02:34.237000",
          "created": "2024-09-01T16:08:15.260000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ccbd92f716bb0ca0fda93d",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 935,
            "URL": 5882,
            "domain": 571,
            "hostname": 1418,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 9054,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "547 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66be22943d7192063b953f75",
          "name": "Unsupported Browser - WordPress.com Brian Sabey Pornography Injection via thebrotherssabey[.]com for Jeffrey Scott Reimer DPT - Lazarus Group related",
          "description": "Brian Sabey Pornography via thebrotherssabey WordPress. Mark Brian Sabey, M. Brian Sabey, Brian Sabey, The Brothers Sabey is the the said name of relentless cyber attacker. Lazarus Group related. Tsara Brashears has been a victim of his abuse for a decade. He and whoever he works for have been responsible for relentless cyber warfare of a critical nature, in person stalking, violence, countless property damage, theft, cameras installation,  hitmen attacks and an assault within 6 week span. Brian Sabey Social engineered target by email, phone, check scam, cyber attacks on music studios, and business, lawsuit representing Jeffrey Reimer and more likely Eva Lisa Reimer. An alleged judge dismissed his case. Reimer & Sabey settled for a pittance as Brashears needed spine surgery, This is crazy.",
          "modified": "2024-10-14T18:03:35.631000",
          "created": "2024-08-15T15:45:24.143000",
          "tags": [
            "browser",
            "helaas",
            "bekijk",
            "url https",
            "all scoreblue",
            "report spam",
            "output",
            "tsara brashears",
            "minutes ago",
            "amber a",
            "continue",
            "view",
            "unsupported",
            "browser",
            "javascript",
            "next",
            "download",
            "videos maps",
            "images news",
            "please",
            "google search",
            "watch",
            "tsara",
            "any",
            "quality",
            "any source",
            "videos",
            "dynamicloader",
            "yara rule",
            "ids detections",
            "yara detections",
            "contacted",
            "high",
            "pyinstaller",
            "dynamic",
            "medium",
            "data",
            "powershell",
            "tofsee",
            "windows",
            "sha256",
            "less see",
            "stream",
            "copy",
            "grum",
            "m417",
            "lazarus",
            "elisa",
            "brian sabey",
            "thebrotherssabey",
            "e lisa",
            "installs",
            "windows startup",
            "google",
            "yandex",
            "microsoft",
            "baidu",
            "baidu spider",
            "yandex spider",
            "apple",
            "android",
            "meta",
            "facebook",
            "cybercrime",
            "cyber warfare",
            "hitmen",
            "malware",
            "malvertising",
            "pornography",
            "pornhub"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "Injected: https://www.google.com/search?q=tsara+brashears&prmd=vni&source=lnms&tbm=vid&sa=X&ved=2ahUKEwimqvSyxKrpAhUHTt8KHReZC7wQ_AUoAXoECAsQAQ&biw=375&bih=544&dpr=3/Malicious-Google-Search-Results-False",
            "Antivirus Detections: Win.Packer.pkr_ce1a-9980177-0",
            "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
            "Alerts: procmem_yara injection_inter_process creates_largekey network_bind persistence_autorun injection_process_hollowing",
            "Alerts: persistence_autorun_tasks spawns_dev_util cape_detected_threat deletes_executed_files suricata_alert",
            "Alerts: antivm_generic_disk antivm_generic_services suspicious_command_tools anomalous_deletefile",
            "Alerts: deletes_self injection_runpe persistence_ads antisandbox_sleep dead_connect",
            "Brian Sabey Jeffrey Scott Reimer DPT Eva Lisa Reimer RN & Quasi Government Insurance companies unwilling to pay for critical assault injuries SCI",
            "http://schemas.microsoft.com/SMI/2016/WindowsSettings"
          ],
          "public": 1,
          "adversary": "Lazarus Group  Brian Sabey",
          "targeted_countries": [
            "United States of America",
            "Finland",
            "France",
            "Croatia",
            "United Kingdom of Great Britain and Northern Ireland",
            "Spain"
          ],
          "malware_families": [
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1055.003",
              "name": "Thread Execution Hijacking",
              "display_name": "T1055.003 - Thread Execution Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1428",
              "name": "Exploit Enterprise Resources",
              "display_name": "T1428 - Exploit Enterprise Resources"
            },
            {
              "id": "T1445",
              "name": "Abuse of iOS Enterprise App Signing Key",
              "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 289,
            "hostname": 70,
            "FileHash-MD5": 125,
            "FileHash-SHA1": 124,
            "FileHash-SHA256": 242,
            "domain": 59,
            "FilePath": 1
          },
          "indicator_count": 910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "552 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ccbb1146fb07a45b6b97fe",
          "name": "Android Remotely Cracked: Swipper? | Being Sabey links found. Framing?",
          "description": "Targets phone and other devices cracked remotely. Phone calls made to a family member by phone. Some clues left behind.\n1 clue:mike@softwarezpro1.txt\nLong Link:http://bbd383ttka22.top/prize/luckyus-ad/nigh.php?c=69zejibbz5fz1&k=987ad34e7843dd8f3a3cb6559f188769&country_code=US&country_name=United%20States\u00aeion=New%20York&city=Plainview&isp=MCI%20Communications%20Services,%20Inc.%20d/b/a%20Verizon%20Business&lang=ja&ref_domain=&os=iOS&osv=16&browser=Chrome&browserv=115&brand=Apple&model=iPhone&marketing_name=iPhone&tablet=2&rheight=0&rwidth=0&e=5\n Stop! Swipper, Brian Sabey, Tulach, whoever you are. Arrest Jeffrey Reimer Scott DPT for groping breasts, V, assaulting so hard it separated victims hips and SI joint, Spinal Cord Injury length of spine. He literally assaulted her brain out. TBI with Arnold's Chiari. Demyelination from brain to toes. He never denied this to Employers. Hi, DPD Major crimes God Bless you...about the report?",
          "modified": "2024-10-14T18:03:35.631000",
          "created": "2024-08-26T17:27:45.763000",
          "tags": [
            "unknown",
            "meta",
            "software",
            "site kit",
            "as53667",
            "free",
            "download full",
            "search",
            "showing",
            "encrypt",
            "date",
            "asnone united",
            "kingdom unknown",
            "wordpress site",
            "just",
            "passive dns",
            "meta http",
            "content",
            "gmt server",
            "a domains",
            "body",
            "server",
            "registrar",
            "dnssec",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "registrar url",
            "version crack",
            "crack serial",
            "keys license",
            "algorithm",
            "whois lookup",
            "creation date",
            "code",
            "namesilo",
            "country",
            "domain status",
            "contact email",
            "first",
            "historical ssl",
            "referrer",
            "cobalt strike",
            "switch dns",
            "query",
            "fraud risk",
            "traffic",
            "luna moth",
            "campaign",
            "analyzer paste",
            "iocs",
            "samples",
            "phishing",
            "malware",
            "maltiverse",
            "cyber threat",
            "engineering",
            "team phishing",
            "mail spammer",
            "telefonica co",
            "emotet",
            "download",
            "malicious",
            "team",
            "suppobox",
            "analyzer threat",
            "url summary",
            "ip summary",
            "summary",
            "sample",
            "detection list",
            "blacklist",
            "module load",
            "service",
            "create c",
            "show",
            "winhttp authip",
            "write c",
            "susp",
            "trojanspy",
            "related pulses",
            "copy",
            "write",
            "win32",
            "memcommit",
            "read c",
            "x00x00",
            "high defense",
            "evasion",
            "defense evasion",
            "cryptexportkey",
            "windows",
            "shellexecuteexw",
            "hash",
            "writeconsolew",
            "registry",
            "t1031",
            "modify existing",
            "trojan",
            "dock",
            "august",
            "push",
            "hostnames",
            "urls http",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malicious site",
            "tofsee",
            "google domain",
            "azorult",
            "runescape",
            "facebook",
            "bank",
            "alexa",
            "zbot",
            "dynamicloader",
            "yara rule",
            "high",
            "grum",
            "medium",
            "ids detections",
            "yara detections",
            "stream",
            "as15169 google",
            "as44273 host",
            "aaaa",
            "scan endpoints",
            "all scoreblue",
            "next",
            "type texthtml",
            "google safe",
            "browsing",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "co20230203",
            "pe resource",
            "url https",
            "archive",
            "posix tar",
            "flow t1574",
            "dll sideloading",
            "media t1091",
            "t1055",
            "spawns",
            "mitre att",
            "access ta0001",
            "replication",
            "dlls privilege",
            "window",
            "ip traffic",
            "udp a83f8110",
            "hashes",
            "t1055 spawns",
            "dlls defense",
            "dns resolutions",
            "user",
            "samplepath",
            "menu files",
            "written c",
            "files copied",
            "files dropped",
            "file",
            "pe32 executable",
            "ms windows",
            "intel",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "contained",
            "info compiler",
            "products id",
            "header intel",
            "name md5",
            "type",
            "language",
            "sha256",
            "data",
            "entries",
            "filehash",
            "av detections",
            "as3215 orange",
            "related",
            "france unknown",
            "reverse dns",
            "singapore asn",
            "as16509",
            "united",
            "updated date",
            "pulse submit",
            "url analysis",
            "verdict",
            "as16342 toya",
            "all search",
            "otx scoreblue",
            "hostname",
            "ip address",
            "poland unknown",
            "moved",
            "gmt contenttype",
            "vary",
            "gmt content",
            "content length",
            "domain",
            "files ip",
            "address",
            "location poland",
            "asn as16342",
            "as16276",
            "as50599",
            "as8075",
            "as5617 orange",
            "a td",
            "as198921",
            "as29686 probe",
            "germany unknown",
            "germany",
            "title",
            "body doctype",
            "html public",
            "ietfdtd html",
            "head body",
            "as63949 linode",
            "united kingdom",
            "arial",
            "apache",
            "accept",
            "related nids",
            "files location",
            "flag united",
            "files domain",
            "files related",
            "as20940",
            "as4230 claro",
            "data redacted",
            "name servers",
            "expiration date",
            "invalid url",
            "mtb feb",
            "body html",
            "head title",
            "hacktool",
            "trojandropper",
            "mtb mar",
            "title head",
            "overview ip",
            "record value",
            "td tr",
            "tr tr",
            "dostpne jzyki",
            "tr table",
            "table",
            "utwrz stref",
            "modyfikuj stref",
            "td td",
            "win32vb",
            "win32qqpass",
            "worm",
            "win32mofksys",
            "worm worm",
            "win32salgorea",
            "support",
            "internet mobile",
            "win32tofsee",
            "as3842 inmotion",
            "as40676 psychz",
            "formbook cnc",
            "checkin",
            "exploit",
            "virtool",
            "trojan features",
            "file samples",
            "files matching",
            "date hash",
            "cname",
            "error",
            "script urls",
            "ezcrack all",
            "script",
            "provides",
            "softwares",
            "script domains",
            "pragma",
            "as202425 ip",
            "emails",
            "as46606",
            "crack",
            "aaaa nxdomain",
            "whitelisted",
            "nxdomain",
            "as36352",
            "malware trojan",
            "asnone",
            "virgin islands",
            "backdoor",
            "please",
            "win32botgor"
          ],
          "references": [
            "aeuwa03.devtest.call2.team | mike@softwarezpro1.txt  | softwarezpro.net | www.softwarezpro.net | mike@ hijacked targets device Attacked!",
            "http://cracx.net/fonepaw-iphone-data-recovery-3-8-0-crack/ | Malware: 74.208.236.140 malacrack.org ns2.filescrack.com ns1.filescrack.com",
            "http://softwarezpro.net/wp-content/themes/wellington/assets/js/svgxuse.min.js?ver=1.2.6",
            "animalpornotube.com | http://animalpornotube.com/files/gifamateurpay.gi | https://crackedvst.info/tag/k7-total-security-trial-resetter/",
            "https://activationskey.net/passfab-iphone-cracked-free-keys-2022 https://crackedvst.info/ui crackedvst.info: http://www.crackidea.net/",
            "http://activationskey.net/passfab-for-rar-full-cracked-2022/ activationskey.net: https://activationskey.net/passware-kit-forensic-2021-1-3-crack/ activationskey.net: |  crackedvst.info:  crackedvst.info:",
            "www.softwarezpro.net\thttps://i0.wp.com/softwarezpro.net/wp parking.namesilo.com softwarezpro.org softwarezap.net  softwarezap.net",
            "anti-spyware-software.net http://softwarezpro.net/wp |  |  http://softwarezpro.net/xmlrpc.php | https://softwarezpro.net https://softwarezpro.net/\t URL\thttps://softwarezpro.net/comments/feed/ https://softwarezpro.net/feed/\t https://softwarezpro.net/page/2/\t URL\thttps://softwarezpro.net/wp https://softwarezpro.net/xmlrpc.php",
            "http://softwarezpro.net/wp-content/themes/wellington/assets/js/navigation.min.js?ver=20220224 | crackedvst.info",
            "pw-90cc2fc574f6dd6dccf2c3531928b039@privacyguardian.org | https://crackedvst.info/antares-autotune-pro-crack/",
            "www.endgame.com [Threatening] | https://mobisoft.info/dfx-audio-enhancer-crack | https://mobisoft.info/passfab-iphone-unlocker-key",
            "7cwork.a-poster.info a-poster.info: members.a-poster.info work.a-poster.info a-poster.info: http://20work.a-poster.info a-poster.info:",
            "http://250awork.a-poster.info/ a-poster.info: http://252fwork.a-poster.info a-poster.info:  http://252fwork.a-poster.info/",
            "20work.a-poster.info a-poster.info: 250awork.a-poster.info a-poster.info:  252fwork.a-poster.info a-poster.info:  a-poster.info:",
            "Trojan:Win32/Salgorea: FileHash-SHA256  e82334440ceddd927f35831fda83594f3657ca56187f7f7ddd7d60cba1be793",
            "Worm:Win32/Fasong: FileHash-SHA256  c7f2f4a6ed374bac385fa81177967fd013248652556e4ee95cea7f064f6b25dd",
            "Trojan:Win32/Glupteba: FileHash-SHA256  5e7fdbc4c66fbefd6aa95047a56c709765f18b3a3a65d5942acb4e4349b09039",
            "Worm:Win32/Mofksys: FileHash-SHA256 ef1a66214e210bc9ae0aef471b0a09f6083078343a0338fcaf1f2b04ebddbd9a",
            "Trojan:Win32/QQpass: FileHash-SHA256 86df64999ed25a02debca89a586c931b0f32b1edc0e7aa800c360be3ef456439",
            "TrojanSpy:Win32/Nivdort.DI: FileHash-SHA256 00734b135321562e7e0df7c2f8eb554435cc25c47f46747f79fc2116ac2cc6ef",
            "Win32:CrypterX-gen\\ [Trj]: FileHash-SHA256 002ea0849da3c63ce6c09c084567e9470c3616084ef19402316e9d52f35c62a7",
            "Trojan:Win32/Emotet.PC!MTB: FileHash-SHA256 02b9cac1880e348302125664c4955fd163a219b1eb8b50de0ad350e0c147a0b0",
            "Trojan:Win32/Zbot.SIBB3!MTB: FileHash-SHA256 bc1739628aadbcc99bcb93caab4a7a73534694c817d57cc0ed735bf4bd0f6e45",
            "ELF:Hajime-Q\\ [Trj] : FileHash-SHA256 aa310469926150f9d6f980dd6ba200d1c9c7dec7c4b66c7de4cff6a30c038560",
            "Win32/Tasekjom.A : FileHash-SHA256 1230ac0c362b6049b9de011229707e05852dd11af75ca7071a1f089e6aca61f5",
            "Win32/Muldrop FileHash-SHA256 67a5e78bb2897b15d510dfce0d89f60330db01d7944ebb4f1dd90ce36c907e1b",
            "PWS:Win32/VB : FileHash-SHA256 dbc78d07e96562c6370ab515f5d65cea88a1b163ad10718c66d15155f4075630",
            "Backdoor:Win32/Tofsee:  FileHash-SHA256 5b616ad2410bef0bc894c4bff013afe2d7f44dcdeb79420bab14c766cc460aa7",
            "VirTool:Win32/Obfuscator FileHash-SHA256 874e78143b683016ef8e41977f9d3ee34b97b145b313cdefdeb3e8900db6df73",
            "RASMONTR.DLL 192.168.56.101",
            "iobit: https://cracxfree.com/iobit-malware-fighter-pro-2/http://activationskey.net/wp-content/uploads/2021/02/download-2-7.jpg",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/00734b135321562e7e0df7c2f8eb554435cc25c47f46747f79fc2116ac2cc6ef",
            "Parked: www.easycrypto.team | 'Parking Crew' ? Several names exist for advesarial 'Parking Hacker Groups'  parking.namesilo.com",
            "Ranks high in search results because device is typically compromised with Convection engine and Keyword Tool",
            "a-fondness-for-beauty.com",
            "iobit: https://cracxfree.com/iobit-malware-fighter-pro-2/ | http://activationskey.net/wp-content/uploads/2021/02/download-2-7.jpg",
            "iobit: https://cracxfree.com/iobit-malware-fighter-pro-2/ | https://cracklink.info/iobit-uninstaller-pro-key/",
            "iobit: https://ezcrack.info/iobit-uninstaller-pro-crack | https://ezcrack.info/iobit-uninstaller-pro-crack/",
            "http://crackedvst.info/plugin-alliance-bundle-crack/: sedoparking.com | sedoparking.com/frmpark/ -",
            "Trojan:Win32/Zbot: FileHash-SHA256 b7875b426ce25f1d4785ba7043bbfdba49feb726cc829d681acdd67c3c302c70",
            "ALF:Trojan:Win32/Cassini_f28c33a2:\tFileHash-SHA256 6fc35cb8e18f0d9d72bc1a7037ae88f8036362799f930a1a30e290d31be3b216",
            "Backdoor:Win32/Botgor: FileHash-SHA256 b70353b3ecf532ad51e7d6a1790275df02c7393b87d40add47a3baccab39802f",
            "TrojanDropper:Win32/Muldrop: FileHash-SHA256  bf8e919cf6ce208f1c2f98f07df835099f14e2f8708197b0165479468079d902",
            "#LowFiCreateRemoteThread:  FileHash-SHA256  0ab94d890afef8ebae42007a119a8686f71bdd9bdf357262481daa7c9c7a283e",
            "Trojan:Win32/Blihan: FileHash-SHA256  dada5208109416153937db5a6f44f03b8b9025347c235acdc70edfa24a2a882e",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 | itunes.apple.com",
            "http://appleid.com-index-manager-info-verify-receipt-account.usa.cc/ |",
            "https://realcrack.info/sidify-apple-music-converter-crack/  | applehouse-jp.com | iappletech.com | http://apple.int-access-accounts.usa.cc/",
            "http://apple-store.jspi304es-services-fixedbilling-responsive-managed-update-card.appleid-storeext.usa.cc/",
            "http://apple-unlocked-login.usa.cc/\t| http://apple.com.locked-account-verify-login.usa.cc/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort.DI",
              "display_name": "TrojanSpy:Win32/Nivdort.DI",
              "target": "/malware/TrojanSpy:Win32/Nivdort.DI"
            },
            {
              "id": "Win32:CrypterX-gen\\ [Trj]",
              "display_name": "Win32:CrypterX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Trojan:Win32/Emotet.PC!MTB",
              "display_name": "Trojan:Win32/Emotet.PC!MTB",
              "target": "/malware/Trojan:Win32/Emotet.PC!MTB"
            },
            {
              "id": "Trojan:Win32/CryptInject",
              "display_name": "Trojan:Win32/CryptInject",
              "target": "/malware/Trojan:Win32/CryptInject"
            },
            {
              "id": "RASMONTR.DLL",
              "display_name": "RASMONTR.DLL",
              "target": null
            },
            {
              "id": "Trojan:Win32/Salgorea",
              "display_name": "Trojan:Win32/Salgorea",
              "target": "/malware/Trojan:Win32/Salgorea"
            },
            {
              "id": "Worm:Win32/Fasong",
              "display_name": "Worm:Win32/Fasong",
              "target": "/malware/Worm:Win32/Fasong"
            },
            {
              "id": "Trojan:Win32/Glupteba",
              "display_name": "Trojan:Win32/Glupteba",
              "target": "/malware/Trojan:Win32/Glupteba"
            },
            {
              "id": "Worm:Win32/Mofksys",
              "display_name": "Worm:Win32/Mofksys",
              "target": "/malware/Worm:Win32/Mofksys"
            },
            {
              "id": "Trojan:Win32/QQpass",
              "display_name": "Trojan:Win32/QQpass",
              "target": "/malware/Trojan:Win32/QQpass"
            },
            {
              "id": "Trojan:Win32/Zbot.SIBB3!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBB3!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBB3!MTB"
            },
            {
              "id": "ELF:Hajime-Q\\ [Trj]",
              "display_name": "ELF:Hajime-Q\\ [Trj]",
              "target": null
            },
            {
              "id": "Win32/Tasekjom.A",
              "display_name": "Win32/Tasekjom.A",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/TrojanDownloader",
              "display_name": "TEL:Trojan:Win32/TrojanDownloader",
              "target": null
            },
            {
              "id": "Win32/TrojanDropper",
              "display_name": "Win32/TrojanDropper",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            },
            {
              "id": "PWS:Win32/VB",
              "display_name": "PWS:Win32/VB",
              "target": "/malware/PWS:Win32/VB"
            },
            {
              "id": "Backdoor:Win32/Tofsee",
              "display_name": "Backdoor:Win32/Tofsee",
              "target": "/malware/Backdoor:Win32/Tofsee"
            },
            {
              "id": "Trojan:Win32/Blihan",
              "display_name": "Trojan:Win32/Blihan",
              "target": "/malware/Trojan:Win32/Blihan"
            },
            {
              "id": "#LowFiCreateRemoteThread",
              "display_name": "#LowFiCreateRemoteThread",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Botgor",
              "display_name": "Backdoor:Win32/Botgor",
              "target": "/malware/Backdoor:Win32/Botgor"
            },
            {
              "id": "ALF:Trojan:Win32/Cassini_f28c33a2",
              "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civilian Devices"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 112,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1629,
            "FileHash-MD5": 4822,
            "URL": 2002,
            "email": 18,
            "hostname": 1725,
            "FileHash-SHA1": 3921,
            "FileHash-SHA256": 9019,
            "URI": 1
          },
          "indicator_count": 23137,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "552 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6523344e4adc85389899504c",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2024-10-13T03:00:28.081000",
          "created": "2023-10-08T22:59:26.040000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b48d699080b4bfd334c5",
          "export_count": 74,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7761,
            "CVE": 6,
            "FileHash-MD5": 285,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 5059,
            "domain": 987,
            "hostname": 2399
          },
          "indicator_count": 16662,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "553 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b75a315eac0ff46fa4510d",
          "name": "Yoda Crypter | Vtapi Virustotal Ransomware | X.Com |  Twitter | Remote Job",
          "description": "Miscellaneous Virustotal attack found. A malicious hash found while researching a malicious Twitter template regarding post found re: otx.alienvault.com pulse.\nFound BorpaToken [moved] attacking X Vercel servers, impacting Azure, impacts X.com, Google.com, YouTube, androids, apple id,  (otx seems impacted) with and /w/o header and every versions of related links, Malicious x.com 'REMOTELY' redirects to malicious Twitter templates with recognized names.",
          "modified": "2024-10-08T11:00:59.828000",
          "created": "2024-08-10T12:16:49.869000",
          "tags": [
            "win32 exe",
            "pe32",
            "intel",
            "ms windows",
            "yoda",
            "crypter",
            "win16 ne",
            "os2 executable",
            "sections",
            "md5 upx0",
            "upx1",
            "upx2",
            "downloads",
            "http posts",
            "mitre att",
            "evasion ta0005",
            "ta0006 input",
            "capture t1056",
            "remote system",
            "discovery t1018",
            "reads",
            "discovery t1082",
            "windows nt",
            "get http",
            "request",
            "pragma",
            "response",
            "memory pattern",
            "g2 tls",
            "rsa sha256",
            "ca1 odigicert",
            "inc cus",
            "hashes",
            "peexe",
            "deleted c",
            "files dropped",
            "json",
            "registry keys",
            "ssl protocol",
            "de ff",
            "c4 a6",
            "fe b9",
            "d7 e8",
            "ed f6",
            "c5 c1",
            "dd f1",
            "e0 ee",
            "dword",
            "samplepath",
            "process",
            "created",
            "shell commands",
            "windir",
            "runtime modules",
            "urls",
            "ip detections",
            "country",
            "us a83f81100",
            "microsoft stuff",
            "malicious proxy",
            "june",
            "referrer",
            "historical ssl",
            "threat roundup",
            "domains",
            "threat network",
            "tracker radar",
            "hunting service",
            "vt ransomware",
            "malicious",
            "ermac",
            "probe",
            "vhash",
            "authentihash",
            "rich pe",
            "ssdeep",
            "magic pe32",
            "trid upx",
            "portable",
            "info compiler",
            "products",
            "vs2008",
            "vs2010 sp1",
            "vs2010",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "registrar",
            "csc corporate",
            "markmonitor inc",
            "ta0009 command",
            "control ta0011",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "command",
            "control ob0004",
            "defense evasion",
            "sample",
            "upx software",
            "upx packed",
            "evasion t1497",
            "may sleep",
            "packing f0001",
            "evasion b0003",
            "f0001 upx",
            "ob0006 software",
            "file",
            "post http",
            "hashes c2ae",
            "capa",
            "cape sandbox",
            "zenbox",
            "user",
            "files deleted",
            "files",
            "calls",
            "as15169 google",
            "united",
            "status",
            "date",
            "name servers",
            "cname",
            "passive dns",
            "search",
            "record value",
            "next",
            "error",
            "code",
            "unknown",
            "trojan",
            "found",
            "gmt contenttype",
            "sameorigin",
            "all scoreblue",
            "trojandropper",
            "matches rule",
            "et info",
            "generic http",
            "exe upload",
            "vtapi",
            "emails",
            "servers",
            "aaaa",
            "domain",
            "as13414 twitter",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "virtool",
            "mirai",
            "analyzer paste",
            "iocs",
            "hostnames",
            "urls https",
            "borpa loading",
            "expiration",
            "url https",
            "akamai rank",
            "hostname",
            "twitter",
            "tsara brashears",
            "ip address",
            "pe resource",
            "apple ios",
            "threats",
            "malware",
            "scripts",
            "norton",
            "excel",
            "hacktool",
            "problem",
            "njrat",
            "ransomware",
            "open",
            "samples",
            "url http",
            "vercel",
            "server attack",
            "yara detections",
            "push",
            "scan endpoints",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "code overlap",
            "related pulses",
            "top source",
            "top destination",
            "source source",
            "copy",
            "host",
            "contentlength",
            "malware beacon",
            "show",
            "entries",
            "cape",
            "write",
            "expiration date",
            "tulach topic",
            "brian sabey",
            "hallrender",
            "apple id",
            "malicious url",
            "tag count",
            "tld count",
            "detection list",
            "blacklist https",
            "count blacklist",
            "tag tag",
            "no data",
            "tld aggregation",
            "combined",
            "contact",
            "as206834 team",
            "canada unknown",
            "div div",
            "redacted for",
            "unknown xn",
            "script script",
            "msie",
            "chrome",
            "precondition",
            "mtb oct",
            "body",
            "worm",
            "trojanspy",
            "xpire.info",
            "searchmeup",
            "as61969 team",
            "creation date",
            "domain robot",
            "win32",
            "et smtp",
            "message",
            "high",
            "mailrubar",
            "trojanclicker",
            "parking crew",
            "parking logic",
            "category",
            "trojan features",
            "file samples",
            "files matching",
            "date hash",
            "showing",
            "creates largekey",
            "threat sniper",
            "crouching yeti",
            "kitten",
            "camaro dragon",
            "google phish",
            "macros",
            "hiddentear",
            "plugins",
            "removes headers",
            "hitmen"
          ],
          "references": [
            "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
            "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
            "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
            "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
            "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
            "https://fixupx.com/Yoda4ever/status/1819058165264404527",
            "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
            "http://borpatoken.com/ borpatoken.com",
            "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
            "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
            "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
            "X Vercel Servers",
            "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
            "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
            "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
            "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
            "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
            "Vtapi: scanter.comwww.twitter.comx.com",
            "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
            "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
            "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
            "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
            "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Win.Trojan.Occamy",
              "display_name": "Win.Trojan.Occamy",
              "target": null
            },
            {
              "id": "W32.AIDetectMalware",
              "display_name": "W32.AIDetectMalware",
              "target": null
            },
            {
              "id": "Trojan.Vtflooder/Vflooder",
              "display_name": "Trojan.Vtflooder/Vflooder",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan:Win32/Vflooder.A",
              "display_name": "Trojan:Win32/Vflooder.A",
              "target": "/malware/Trojan:Win32/Vflooder.A"
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Xpire.info",
              "display_name": "Xpire.info",
              "target": null
            },
            {
              "id": "Searchmeup",
              "display_name": "Searchmeup",
              "target": null
            },
            {
              "id": "Trojan:Win32/Trickler",
              "display_name": "Trojan:Win32/Trickler",
              "target": "/malware/Trojan:Win32/Trickler"
            },
            {
              "id": "Trojan:Win32/Comame",
              "display_name": "Trojan:Win32/Comame",
              "target": "/malware/Trojan:Win32/Comame"
            },
            {
              "id": "#VirTool:Win32/Obfuscator",
              "display_name": "#VirTool:Win32/Obfuscator",
              "target": "/malware/#VirTool:Win32/Obfuscator"
            },
            {
              "id": "Trojan:Win32/Pariham",
              "display_name": "Trojan:Win32/Pariham",
              "target": "/malware/Trojan:Win32/Pariham"
            }
          ],
          "attack_ids": [
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 57,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1943,
            "FileHash-SHA1": 1637,
            "FileHash-SHA256": 3321,
            "URL": 1030,
            "domain": 646,
            "hostname": 1473,
            "email": 7,
            "CVE": 2
          },
          "indicator_count": 10059,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "558 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b759cf57d491a9dcca8c17",
          "name": "Yoda Crypter | Vtapi Virustotal Ransomware | X.Com |  Twitter | Remote Job",
          "description": "Miscellaneous Virustotal attack found. A malicious hash found while researching a malicious Twitter template regarding post found re: otx.alienvault.com pulse.\nFound BorpaToken [moved] attacking X Vercel servers, impacting Azure, impacts X.com, Google.com, YouTube, androids, apple id,  (otx seems impacted) with and /w/o header and every versions of related links, Malicious x.com 'REMOTELY' redirects to malicious Twitter templates with recognized names.",
          "modified": "2024-10-08T11:00:59.828000",
          "created": "2024-08-10T12:15:11.526000",
          "tags": [
            "win32 exe",
            "pe32",
            "intel",
            "ms windows",
            "yoda",
            "crypter",
            "win16 ne",
            "os2 executable",
            "sections",
            "md5 upx0",
            "upx1",
            "upx2",
            "downloads",
            "http posts",
            "mitre att",
            "evasion ta0005",
            "ta0006 input",
            "capture t1056",
            "remote system",
            "discovery t1018",
            "reads",
            "discovery t1082",
            "windows nt",
            "get http",
            "request",
            "pragma",
            "response",
            "memory pattern",
            "g2 tls",
            "rsa sha256",
            "ca1 odigicert",
            "inc cus",
            "hashes",
            "peexe",
            "deleted c",
            "files dropped",
            "json",
            "registry keys",
            "ssl protocol",
            "de ff",
            "c4 a6",
            "fe b9",
            "d7 e8",
            "ed f6",
            "c5 c1",
            "dd f1",
            "e0 ee",
            "dword",
            "samplepath",
            "process",
            "created",
            "shell commands",
            "windir",
            "runtime modules",
            "urls",
            "ip detections",
            "country",
            "us a83f81100",
            "microsoft stuff",
            "malicious proxy",
            "june",
            "referrer",
            "historical ssl",
            "threat roundup",
            "domains",
            "threat network",
            "tracker radar",
            "hunting service",
            "vt ransomware",
            "malicious",
            "ermac",
            "probe",
            "vhash",
            "authentihash",
            "rich pe",
            "ssdeep",
            "magic pe32",
            "trid upx",
            "portable",
            "info compiler",
            "products",
            "vs2008",
            "vs2010 sp1",
            "vs2010",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "registrar",
            "csc corporate",
            "markmonitor inc",
            "ta0009 command",
            "control ta0011",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "command",
            "control ob0004",
            "defense evasion",
            "sample",
            "upx software",
            "upx packed",
            "evasion t1497",
            "may sleep",
            "packing f0001",
            "evasion b0003",
            "f0001 upx",
            "ob0006 software",
            "file",
            "post http",
            "hashes c2ae",
            "capa",
            "cape sandbox",
            "zenbox",
            "user",
            "files deleted",
            "files",
            "calls",
            "as15169 google",
            "united",
            "status",
            "date",
            "name servers",
            "cname",
            "passive dns",
            "search",
            "record value",
            "next",
            "error",
            "code",
            "unknown",
            "trojan",
            "found",
            "gmt contenttype",
            "sameorigin",
            "all scoreblue",
            "trojandropper",
            "matches rule",
            "et info",
            "generic http",
            "exe upload",
            "vtapi",
            "emails",
            "servers",
            "aaaa",
            "domain",
            "as13414 twitter",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "virtool",
            "mirai",
            "analyzer paste",
            "iocs",
            "hostnames",
            "urls https",
            "borpa loading",
            "expiration",
            "url https",
            "akamai rank",
            "hostname",
            "twitter",
            "tsara brashears",
            "ip address",
            "pe resource",
            "apple ios",
            "threats",
            "malware",
            "scripts",
            "norton",
            "excel",
            "hacktool",
            "problem",
            "njrat",
            "ransomware",
            "open",
            "samples",
            "url http",
            "vercel",
            "server attack",
            "yara detections",
            "push",
            "scan endpoints",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "code overlap",
            "related pulses",
            "top source",
            "top destination",
            "source source",
            "copy",
            "host",
            "contentlength",
            "malware beacon",
            "show",
            "entries",
            "cape",
            "write",
            "expiration date",
            "tulach topic",
            "brian sabey",
            "hallrender",
            "apple id",
            "malicious url",
            "tag count",
            "tld count",
            "detection list",
            "blacklist https",
            "count blacklist",
            "tag tag",
            "no data",
            "tld aggregation",
            "combined",
            "contact",
            "as206834 team",
            "canada unknown",
            "div div",
            "redacted for",
            "unknown xn",
            "script script",
            "msie",
            "chrome",
            "precondition",
            "mtb oct",
            "body",
            "worm",
            "trojanspy",
            "xpire.info",
            "searchmeup",
            "as61969 team",
            "creation date",
            "domain robot",
            "win32",
            "et smtp",
            "message",
            "high",
            "mailrubar",
            "trojanclicker",
            "parking crew",
            "parking logic",
            "category",
            "trojan features",
            "file samples",
            "files matching",
            "date hash",
            "showing",
            "creates largekey",
            "threat sniper",
            "crouching yeti",
            "kitten",
            "camaro dragon",
            "google phish",
            "macros",
            "hiddentear",
            "plugins",
            "removes headers",
            "hitmen"
          ],
          "references": [
            "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
            "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
            "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
            "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
            "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
            "https://fixupx.com/Yoda4ever/status/1819058165264404527",
            "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
            "http://borpatoken.com/ borpatoken.com",
            "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
            "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
            "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
            "X Vercel Servers",
            "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
            "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
            "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
            "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
            "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
            "Vtapi: scanter.comwww.twitter.comx.com",
            "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
            "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
            "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
            "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
            "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Win.Trojan.Occamy",
              "display_name": "Win.Trojan.Occamy",
              "target": null
            },
            {
              "id": "W32.AIDetectMalware",
              "display_name": "W32.AIDetectMalware",
              "target": null
            },
            {
              "id": "Trojan.Vtflooder/Vflooder",
              "display_name": "Trojan.Vtflooder/Vflooder",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan:Win32/Vflooder.A",
              "display_name": "Trojan:Win32/Vflooder.A",
              "target": "/malware/Trojan:Win32/Vflooder.A"
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Xpire.info",
              "display_name": "Xpire.info",
              "target": null
            },
            {
              "id": "Searchmeup",
              "display_name": "Searchmeup",
              "target": null
            },
            {
              "id": "Trojan:Win32/Trickler",
              "display_name": "Trojan:Win32/Trickler",
              "target": "/malware/Trojan:Win32/Trickler"
            },
            {
              "id": "Trojan:Win32/Comame",
              "display_name": "Trojan:Win32/Comame",
              "target": "/malware/Trojan:Win32/Comame"
            },
            {
              "id": "#VirTool:Win32/Obfuscator",
              "display_name": "#VirTool:Win32/Obfuscator",
              "target": "/malware/#VirTool:Win32/Obfuscator"
            },
            {
              "id": "Trojan:Win32/Pariham",
              "display_name": "Trojan:Win32/Pariham",
              "target": "/malware/Trojan:Win32/Pariham"
            }
          ],
          "attack_ids": [
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 55,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1943,
            "FileHash-SHA1": 1637,
            "FileHash-SHA256": 3321,
            "URL": 1014,
            "domain": 645,
            "hostname": 1472,
            "email": 7,
            "CVE": 2
          },
          "indicator_count": 10041,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "558 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "670268310c19cecfd0fdce4b",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey - Pornhub Campaigns X.Com",
          "description": "",
          "modified": "2024-10-06T10:36:33.718000",
          "created": "2024-10-06T10:36:33.718000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb08c239be3721ab6c9050",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "560 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb08c239be3721ab6c9050",
          "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration to Twitter",
          "description": "",
          "modified": "2024-10-06T10:30:32.632000",
          "created": "2024-09-18T17:07:14.432000",
          "tags": [
            "url https",
            "filehashsha256",
            "browse scan",
            "report spam",
            "author",
            "output",
            "tsara brashears",
            "created",
            "days ago",
            "showing",
            "trojan",
            "win32",
            "msil",
            "trojanspy",
            "virtool",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "author avatar",
            "fraud",
            "june",
            "worm",
            "search",
            "tsara type",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "url http",
            "ipv6",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "sort",
            "least",
            "researched",
            "f https",
            "scan",
            "iocs",
            "learn more",
            "filehashmd5",
            "hostname",
            "domain",
            "indicators show",
            "browser",
            "unsupported",
            "view",
            "continue",
            "watch tsara",
            "searchtsa",
            "brashears",
            "most relevant",
            "porn videos",
            "download",
            "google search",
            "open threat",
            "babe",
            "green",
            "daily",
            "play",
            "fullscreen",
            "tsara",
            "videos",
            "love",
            "top tsara",
            "xxx videos",
            "hardcore porn",
            "jeffrey reimer",
            "puts",
            "porn",
            "javascript",
            "body",
            "creation date",
            "record value",
            "united",
            "gmt content",
            "gmt max",
            "age900",
            "httponly x",
            "date",
            "unknown",
            "pragma",
            "levelblue",
            "exchange open",
            "threat exchange",
            "indicator",
            "safebae",
            "get involved",
            "anyone else",
            "press",
            "data reports",
            "teen students",
            "become",
            "chapter lead",
            "become a",
            "certified peer",
            "district",
            "brian sabey",
            "sabey data",
            "hallrender",
            "sabey data centers",
            "swipper",
            "mark b sabey",
            "m brian sabey",
            "2beeg",
            "thebrotherssabey",
            "urls",
            "show",
            "cloudflarenet",
            "us urlscan",
            "skip",
            "accessibility",
            "all images",
            "videos shopping",
            "forums news",
            "web more",
            "tools",
            "service",
            "malicious",
            "size",
            "recent",
            "off blur",
            "find",
            "summary",
            "securitytrails",
            "urlscan https",
            "tryporn",
            "icann whois",
            "data problem",
            "disclaimer",
            "judaporn",
            "kompoz",
            "blur filter",
            "search results",
            "xxxvideohd",
            "hacker news",
            "item",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "september",
            "domains",
            "sale worldwide",
            "street",
            "gate parkway",
            "stateprovince",
            "postal code",
            "route",
            "open",
            "watch",
            "links",
            "footer",
            "delete see",
            "delete c",
            "tofsee",
            "grum",
            "entries",
            "cape",
            "high",
            "total",
            "copy",
            "write",
            "malware",
            "patched",
            "next",
            "please"
          ],
          "references": [
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
            "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
            "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
            "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
            "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
            "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
            "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
            "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
            "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
            "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
            "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
            "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
            "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
            "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
            "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
            "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
            "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
            "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
            "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
            "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
            "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
            "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
            "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
            "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
            "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
            "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
            "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
            "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
            "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
            "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
            "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
            "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
            "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
            "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
            "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
            "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
            "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
            "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
            "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
            "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
            "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
            "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
            "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
            "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
            "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
            "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
            "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
            "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
            "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
            "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
            "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
            "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
            "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
            "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
            "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
            "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
            "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
            "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
            "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
            "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
            "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
            "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
            "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
            "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
            "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
            "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
            "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
            "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
            "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
            "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
            "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
          ],
          "public": 1,
          "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Win32/Tofsee.AX",
              "display_name": "Win32/Tofsee.AX",
              "target": null
            },
            {
              "id": "Trojan:Win32/Muldrop",
              "display_name": "Trojan:Win32/Muldrop",
              "target": "/malware/Trojan:Win32/Muldrop"
            }
          ],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1055.013",
              "name": "Process Doppelg\u00e4nging",
              "display_name": "T1055.013 - Process Doppelg\u00e4nging"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66d4916fa7338286448118a1",
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 121,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 443,
            "URL": 1878,
            "domain": 312,
            "hostname": 518,
            "email": 5,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3395,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "560 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c52e830f0f0b98744fc83c",
          "name": "Ransom:Win32/LockScreen.BN",
          "description": "",
          "modified": "2024-09-15T14:36:33.834000",
          "created": "2024-08-21T00:02:11.443000",
          "tags": [
            "browser",
            "navegador",
            "ver los",
            "download",
            "tsara brashears",
            "tsara",
            "links",
            "search",
            "watch tsara",
            "google search",
            "please click",
            "accessibility",
            "skip",
            "footer",
            "url https",
            "all scoreblue",
            "report spam",
            "output",
            "hours ago",
            "amber a",
            "porn",
            "malvertising",
            "thebrotherssabey",
            "injection",
            "contacted",
            "cybercrime",
            "view",
            "unsupported",
            "javascript",
            "download",
            "get her",
            "videos maps",
            "images news",
            "fake news",
            "please",
            "let me jerk",
            "pornhub subsidiary",
            "google search",
            "any source",
            "videos",
            "watch",
            "any quality",
            "any quality videos",
            "as47846",
            "germany unknown",
            "levelblue",
            "open threat",
            "endpoints all",
            "spam",
            "brashears",
            "xxx videos",
            "researched",
            "url http",
            "college guy",
            "fuck",
            "available now",
            "pics",
            "vids",
            "custom and",
            "premade",
            "feet pics",
            "and vids",
            "tape",
            "diamond",
            "maya",
            "xxx video",
            "twitter",
            "brian sabey",
            "hallrender",
            "delete c",
            "crlf line",
            "ms windows",
            "intel",
            "united",
            "write c",
            "utf8",
            "read c",
            "show",
            "unknown",
            "copy",
            "plugx",
            "write",
            "malware",
            "winnt",
            "next",
            "encrypt",
            "jaik",
            "heur",
            "custom malware",
            "botnet",
            "templates",
            "dynamicloader",
            "high",
            "yara rule",
            "tofsee",
            "windows",
            "medium",
            "sha256",
            "ids detections",
            "yara detections",
            "less see",
            "stream",
            "grum",
            "ransom",
            "delphi",
            "attempts",
            "power",
            "sniffs",
            "guard",
            "images"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "https://www.google.com/search?q=tsara+brashears&prmd=vni&source=lnms&tbm=vid&sa=X&ved=2ahUKEwimqvSyxKrpAhUHTt8KHReZC7wQ_AUoAXoECAsQAQ&biw=375&bih=544&dpr=3/Malicious-Google-Search-Results-False",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
            "d1.cnbd.net  localhost.cnbd.net  mail.cnbd.net",
            "https://otx.alienvault.com/indicator/url/http://manage.netflix.com.usermanagement.key.1973573.net-server1.com",
            "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger/",
            "Antivirus Detections: Win.Malware.Jaik-9940406-0",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "Yara Defections: ConventionEngine_Keyword_Install Alerts PlugX",
            "Alerts: PlugX cape_extracted_content",
            "Antivirus Detections: Win.Packer.pkr_ce1a-9980177-0",
            "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
            "Alerts: procmem_yara injection_inter_process creates_largekey network_bind persistence_autorun antivm_generic_disk",
            "Alerts: persistence_autorun_tasks spawns_dev_util cape_detected_threat injection_process_hollowing",
            "Antivirus Detections: Win.Malware.Shellstartup-9892532-0 ,  Ransom:Win32/LockScreen.BN",
            "Yara Detections: Zeppelin_24 ,  Zeppelin_30 ,  Delphi",
            "Alerts: procmem_yara persistence_autorun modify_proxy disables_power_options",
            "Alerts: infostealer_cookies infostealer_keylog recon_fingerprint suspicious_command_tools",
            "Ransom:Win32/LockScreen.BN"
          ],
          "public": 1,
          "adversary": "Brian Sabey| The Brothers Sabey",
          "targeted_countries": [
            "United States of America",
            "Finland",
            "France",
            "Spain",
            "Croatia",
            "United Kingdom of Great Britain and Northern Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Jaik-9940406-0",
              "display_name": "Win.Malware.Jaik-9940406-0",
              "target": null
            },
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Win.Malware.Shellstartup-9892532-0",
              "display_name": "Win.Malware.Shellstartup-9892532-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/LockScreen.BN",
              "display_name": "Ransom:Win32/LockScreen.BN",
              "target": "/malware/Ransom:Win32/LockScreen.BN"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Media",
            "Civilian Society",
            "Advocacy"
          ],
          "TLP": "green",
          "cloned_from": "66bf6eae14cd8d0495a31fc7",
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 267,
            "URL": 733,
            "domain": 130,
            "FileHash-SHA256": 1915,
            "FileHash-MD5": 620,
            "FileHash-SHA1": 534,
            "email": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 4206,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "581 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66be27ab9c5385b10cbd25cd",
          "name": "Google Search injection| Tofsee |  Brian Sabey Campaign - Lazarus related | thebrotherssabey.com -Source of entire cyber attack against Sex Assault victim ",
          "description": "",
          "modified": "2024-09-14T18:25:01.247000",
          "created": "2024-08-15T16:07:07.541000",
          "tags": [
            "browser",
            "helaas",
            "bekijk",
            "url https",
            "all scoreblue",
            "report spam",
            "output",
            "tsara brashears",
            "minutes ago",
            "amber a",
            "continue",
            "view",
            "unsupported",
            "browser",
            "javascript",
            "next",
            "download",
            "videos maps",
            "images news",
            "please",
            "google search",
            "watch",
            "tsara",
            "any",
            "quality",
            "any source",
            "videos",
            "dynamicloader",
            "yara rule",
            "ids detections",
            "yara detections",
            "contacted",
            "high",
            "pyinstaller",
            "dynamic",
            "medium",
            "data",
            "powershell",
            "tofsee",
            "windows",
            "sha256",
            "less see",
            "stream",
            "copy",
            "grum",
            "m417",
            "lazarus",
            "elisa",
            "brian sabey",
            "thebrotherssabey",
            "e lisa",
            "installs",
            "windows startup",
            "google",
            "yandex",
            "microsoft",
            "baidu",
            "baidu spider",
            "yandex spider",
            "apple",
            "android",
            "meta",
            "facebook",
            "cybercrime",
            "cyber warfare",
            "hitmen",
            "malware",
            "malvertising",
            "pornography",
            "pornhub"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
            "Injected: https://www.google.com/search?q=tsara+brashears&prmd=vni&source=lnms&tbm=vid&sa=X&ved=2ahUKEwimqvSyxKrpAhUHTt8KHReZC7wQ_AUoAXoECAsQAQ&biw=375&bih=544&dpr=3/Malicious-Google-Search-Results-False",
            "Antivirus Detections: Win.Packer.pkr_ce1a-9980177-0",
            "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
            "Alerts: procmem_yara injection_inter_process creates_largekey network_bind persistence_autorun injection_process_hollowing",
            "Alerts: persistence_autorun_tasks spawns_dev_util cape_detected_threat deletes_executed_files suricata_alert",
            "Alerts: antivm_generic_disk antivm_generic_services suspicious_command_tools anomalous_deletefile",
            "Alerts: deletes_self injection_runpe persistence_ads antisandbox_sleep dead_connect",
            "Brian Sabey Jeffrey Scott Reimer DPT Eva Lisa Reimer RN & Quasi Government Insurance companies unwilling to pay for critical assault injuries SCI",
            "http://schemas.microsoft.com/SMI/2016/WindowsSettings"
          ],
          "public": 1,
          "adversary": "Lazarus Group  Brian Sabey",
          "targeted_countries": [
            "United States of America",
            "Finland",
            "France",
            "Croatia",
            "United Kingdom of Great Britain and Northern Ireland",
            "Spain"
          ],
          "malware_families": [
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1055.003",
              "name": "Thread Execution Hijacking",
              "display_name": "T1055.003 - Thread Execution Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1428",
              "name": "Exploit Enterprise Resources",
              "display_name": "T1428 - Exploit Enterprise Resources"
            },
            {
              "id": "T1445",
              "name": "Abuse of iOS Enterprise App Signing Key",
              "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66be22943d7192063b953f75",
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 74,
            "hostname": 49,
            "FileHash-MD5": 125,
            "FileHash-SHA1": 124,
            "FileHash-SHA256": 178,
            "domain": 31,
            "FilePath": 1
          },
          "indicator_count": 582,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "582 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d95bd10bfcc8c3dd66a44d",
          "name": "Qbot ",
          "description": "",
          "modified": "2024-09-05T09:51:10.113000",
          "created": "2024-09-05T07:20:49.138000",
          "tags": [
            "whois record",
            "ssl certificate",
            "historical ssl",
            "resolutions",
            "referrer",
            "communicating",
            "subdomains",
            "domains",
            "problems",
            "urls http",
            "ransomware",
            "malware",
            "contacted",
            "dropped",
            "execution",
            "tsara brashears",
            "apple ios",
            "whois whois",
            "unlocker",
            "njrat",
            "core",
            "hacktool",
            "metro",
            "download",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "awful",
            "open",
            "banker",
            "keylogger",
            "malicious",
            "tofsee",
            "mitre attack",
            "et",
            "cisco umbrella",
            "internet storm",
            "site",
            "covid19",
            "cyber threat",
            "safe site",
            "cobalt strike",
            "malicious url",
            "alexa",
            "script urls",
            "united",
            "a domains",
            "as396982 google",
            "as15169 google",
            "search",
            "cname",
            "accept encoding",
            "showing",
            "unknown",
            "date",
            "body",
            "meta",
            "encrypt",
            "domain related",
            "as396982",
            "creation date",
            "expiration date",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "pulse submit",
            "url analysis",
            "passive dns",
            "urls",
            "next",
            "all search",
            "otx octoseek",
            "as7922 comcast",
            "as16276",
            "as54113",
            "aaaa",
            "france unknown",
            "as14061",
            "status",
            "as40509",
            "ip address",
            "for privacy",
            "as44273 host",
            "record value",
            "certificate",
            "gmt content",
            "x sucuri",
            "as8075",
            "nxdomain",
            "as30148 sucuri",
            "as20940",
            "as31898 oracle",
            "hong kong",
            "as139021",
            "msie",
            "chrome",
            "ipv4",
            "blacklist http",
            "detection list",
            "blacklist",
            "files",
            "location hong",
            "kong asn",
            "tags none",
            "indicator facts",
            "name verdict",
            "falcon sandbox",
            "mail spammer",
            "tor known",
            "tor relayrouter",
            "exit",
            "node tcp",
            "traffic",
            "heur",
            "malicious site",
            "alexa top",
            "million",
            "alexa proxy",
            "outbreak",
            "installcore",
            "acint",
            "conduit",
            "installpack",
            "iobit",
            "artemis",
            "dropper",
            "mediaget",
            "crack",
            "spammer",
            "france mail",
            "summary",
            "url summary",
            "phishing",
            "union",
            "team",
            "bank",
            "unsafe",
            "threat report",
            "ip summary",
            "pattern match",
            "script",
            "et tor",
            "known tor",
            "relayrouter",
            "node traffic",
            "misc attack",
            "beginstring",
            "null",
            "error",
            "span",
            "class",
            "generator",
            "refresh",
            "tools",
            "hybrid",
            "general",
            "click",
            "strings",
            "servers",
            "ps ord",
            "name servers",
            "poetry",
            "moved",
            "content length",
            "content type",
            "x powered",
            "poems",
            "poem",
            "topic",
            "topics",
            "poem topics",
            "free poems",
            "love poems",
            "romantic poems",
            "classic poems",
            "friendship poems",
            "shone pale",
            "herself",
            "heavens",
            "her beam",
            "a fleecy",
            "proud evening",
            "star",
            "thou bearest",
            "heaven",
            "than",
            "google",
            "http",
            "leasewebuklon11",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "february",
            "gb summary",
            "london",
            "april",
            "screenshot",
            "url https",
            "reverse dns",
            "general full",
            "name value",
            "frankfurt",
            "main",
            "germany",
            "asn15169",
            "resource",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "blacklist https",
            "phishing site",
            "malware site",
            "riskware",
            "opencandy",
            "cleaner",
            "iframe",
            "xtrat",
            "agent",
            "softcnapp",
            "generic",
            "patcher",
            "driverpack",
            "exploit",
            "mimikatz",
            "downldr",
            "presenoker",
            "fusioncore",
            "wacatac",
            "beach research",
            "trojanspy",
            "maltiverse",
            "firehol",
            "proxy",
            "anonymizer",
            "adware",
            "kuaizip",
            "downer",
            "tag count",
            "tue apr",
            "sample",
            "samples",
            "fakealert",
            "genkryptik",
            "icedid",
            "coinminer",
            "nircmd",
            "swrort",
            "systweak",
            "behav",
            "tiggre",
            "filetour",
            "quasar rat",
            "fuery",
            "bazaloader",
            "media",
            "facebook",
            "service",
            "runescape",
            "webtoolbar",
            "a9dia",
            "a1ginaprincipal",
            "emails",
            "registrar",
            "http header",
            "tcp traffic",
            "et useragents",
            "unknown traffic",
            "antivirus",
            "server",
            "gmt united",
            "accept",
            "local",
            "path",
            "falcon",
            "file",
            "ascii text",
            "windows nt",
            "png image",
            "appdata",
            "jpeg image",
            "indicator",
            "twitter",
            "westlaw njrat",
            "zuorat",
            "skynet bot",
            "glupteba",
            "asn4583",
            "thomsonreuters",
            "asn209242",
            "june",
            "back",
            "united kingdom",
            "cisco",
            "umbrella rank",
            "rank",
            "page url",
            "as autonomous",
            "system",
            "yndx",
            "ipasns ip",
            "november",
            "de summary",
            "comodo rsa",
            "security tls",
            "software",
            "resource hash",
            "security",
            "ecdhersa",
            "de indicators",
            "de page",
            "url history",
            "javascript",
            "gts ca",
            "secure server",
            "markmonitor",
            "ip information",
            "detail domains",
            "domain tree",
            "links certs",
            "frames domain",
            "requested",
            "threat roundup",
            "march",
            "threat round",
            "parent parent",
            "roundup",
            "january",
            "threats",
            "qbot",
            "cyberwar",
            "skynet",
            "radar ineractive",
            "control server",
            "engineering",
            "host",
            "services",
            "pony",
            "nanocore rat",
            "meterpreter",
            "zeus",
            "zbot",
            "suppobox",
            "stealer",
            "redline stealer",
            "dnspionage",
            "mirai",
            "nanocore",
            "bradesco",
            "emotet",
            "laplasclipper",
            "asn16276",
            "get h2",
            "kb image",
            "august",
            "kali",
            "localappdata",
            "network traffic",
            "binary file",
            "svg scalable",
            "vector graphics",
            "mwin",
            "domain",
            "url http",
            "pulse pulses",
            "related nids",
            "files location",
            "customer",
            "address",
            "as29789",
            "hosting",
            "location united",
            "status hostname",
            "query type",
            "address first",
            "seen last",
            "seen asn",
            "country unknown",
            "urls date",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "present mar",
            "pulse indicator",
            "protocol h2",
            "value",
            "variables",
            "waypoint object",
            "gsqueue",
            "isotope",
            "hostnames",
            "ice fog",
            "maltiverse top",
            "financial",
            "as62597 nsone",
            "sec ch",
            "domains show",
            "entries",
            "as14720 gamma",
            "canada unknown",
            "as397241",
            "as13335",
            "applicunwnt",
            "xrat",
            "maltiverse safe",
            "aig",
            "soc",
            "hallrender",
            "brian sabey",
            "mark brian sabey",
            "sabey",
            "mark",
            "sabey",
            "data center",
            "malvertizing",
            "malware host",
            "scanning host",
            "botnetwork",
            "colorado",
            "edsaid",
            "geotracking",
            "satellite tracking",
            "radar tracking",
            "pornhub",
            "child teen content illegal",
            "social engineering",
            "cyber stalking",
            "CVE-2023-4966",
            "device control",
            "camera usage",
            "hidden users",
            "message interception",
            "text archiver",
            "mail collection",
            "remote attacks",
            "js",
            "python",
            "inject",
            "sql",
            "extraction",
            "AIG Claims",
            "hallrender.com",
            "soc",
            "milemighmedia",
            "westlaw",
            "revengeporn",
            "bot",
            "regex",
            "ai",
            "yandex"
          ],
          "references": [
            "web2.westlaw.com    (redirects to thbrzzrstr.me)",
            "http://web2.westlaw.com/ (redirect) https://signon.thomsonreuters.com/?productid=CBT&lr=0&culture=en-US&returnto=https%3a%2f%2f1.next.westlaw.com%...",
            "https://hybrid-analysis.com/sample/8bf763ce9396c4569afbae58392097fd57408339c0ac59ec256468c9fd8ac4c5/6548ebfe56b25bab28017757",
            "https://urlscan.io/result/2285cee3-1e08-4e63-b48f-ee685e008480/#summary",
            "https://hybrid-analysis.com/sample/86479bf7c9a675913b93a0d399f5cbe0c0e8003239e93ae5e00f97cdbc5ec5ba/5c5c13577ca3e12626364777",
            "https://urlscan.io/result/4f0cabbf-9716-47dd-bd5c-038a953e6672/",
            "Malware Host: HallRender.com",
            "riverside.rocks (safebae.com remote uTorrent) https://hybrid-analysis.com/sample/11108ef17bd75f36e0d22d95b1f3bde3e9fa968a78a24c2d2508f4238e22651d/6326a50be4a8a71b885f5bf3",
            "safebae.org",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu    (phishing | cybercrime)",
            "Hallrender.com and Westlaw.com.= http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "Poemhunter.com + rally point.com = pornhub.dev",
            "Pornhub dev VT community: https://www.virustotal.com/gui/domain/pornhub.dev/community",
            "Poemhunter.com: https://hybrid-analysis.com/sample/86479bf7c9a675913b93a0d399f5cbe0c0e8003239e93ae5e00f97cdbc5ec5ba",
            "https://www.poemhunter.com/tsara-brashears/poems/: https://urlscan.io/result/4f0cabbf-9716-47dd-bd5c-038a953e6672/",
            "Rallypoint.com https://hybrid-analysis.com/sample/66287c2c36699037cb504201693e26b5f3282cebde1d1c78aecd6f97f04fb694",
            "Malicious revenge malvertizing: https://www.milehighmedia.com/legal/2257",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://matrix.pornhub.dev",
            "nr-data.net",
            "https://www.hallrender.com/wp-content/themes/Hall-Render/assets/icons/apple-touch-icon-76x76.png",
            "https://www.hallrender.com/wp-content/themes/Hall-Render/assets/icons/apple-touch-icon.png",
            "https://apple.pantion.top/",
            "newrelic.se",
            "user-apple.info",
            "appleid-comloginaccount.info",
            "init-p01st.push.apple.com",
            "boostmobile.com",
            "www.metrobyt-mobile.com",
            "http://bpdb.portal.gov.bd:3128/sites/default/files/files/bpdb.portal.gov.bd/npfblock/2021-34bc869d2906198362a4346373ce5b94.jpg",
            "https://b.link/infringement",
            "my.mintmobile.com",
            "CVE-2023-4966",
            "http://watchhers.net/index.php",
            "https://rr2---sn-4g5ednsz.googlevideo.com/videoplayback?expire=1699319292&ei=nDlJZfb4G43E-gaYt5XoDg&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Spain",
            "Netherlands",
            "Canada",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Tsara Brashears",
              "display_name": "Tsara Brashears",
              "target": null
            },
            {
              "id": "Mitre Attack",
              "display_name": "Mitre Attack",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1423",
              "name": "Network Service Scanning",
              "display_name": "T1423 - Network Service Scanning"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1563",
              "name": "Remote Service Session Hijacking",
              "display_name": "T1563 - Remote Service Session Hijacking"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1427",
              "name": "Attack PC via USB Connection",
              "display_name": "T1427 - Attack PC via USB Connection"
            },
            {
              "id": "T1445",
              "name": "Abuse of iOS Enterprise App Signing Key",
              "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key"
            },
            {
              "id": "T1453",
              "name": "Abuse Accessibility Features",
              "display_name": "T1453 - Abuse Accessibility Features"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1173",
              "name": "Dynamic Data Exchange",
              "display_name": "T1173 - Dynamic Data Exchange"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "654971c396ca4306a6534b12",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4091,
            "hostname": 2422,
            "URL": 3167,
            "FileHash-MD5": 1424,
            "FileHash-SHA1": 983,
            "FileHash-SHA256": 3174,
            "CVE": 10,
            "email": 25
          },
          "indicator_count": 15296,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 234,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fee4dec993692315eb9e9",
          "name": "NjRAT | Threat Network | https://www.poemhunter.com/tsara-brashears  ",
          "description": "",
          "modified": "2024-09-05T07:13:57.083000",
          "created": "2023-12-18T07:01:33.682000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657fed19f6d24e751fa82de8",
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2775,
            "URL": 7125,
            "domain": 1726,
            "hostname": 2417
          },
          "indicator_count": 14348,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b3fb6752ac464268b971b1",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA.\nContact made. Physical records. Client: Brashears.\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/\n1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376\nhttps://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/\nhttps://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html\nTEL:Trojan:Win32/BazaarLoader\n987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7",
          "modified": "2024-09-05T07:02:20.491000",
          "created": "2024-01-26T18:35:19.690000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2401,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5377,
            "domain": 3794,
            "hostname": 2763,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 18927,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85df45cc3d3fd07139ea9",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
          "description": "",
          "modified": "2024-09-05T06:38:09.443000",
          "created": "2024-01-30T02:24:52.774000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b47501fcbc39983f098723",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2390,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4357,
            "domain": 3534,
            "hostname": 2670,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17111,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6687495ad1e4ef814ec26c75",
          "name": "Remote Network Attack | JakyllHyde: Malicious Keyword Tool Index | Sabey Data Centers",
          "description": "Research shows compromise originated from Sabey Data Centers. High Priority 'Malicious' \nRemotely connects to victim network is injection,",
          "modified": "2024-09-05T06:26:17.295000",
          "created": "2024-07-05T01:16:10.251000",
          "tags": [
            "read c",
            "get na",
            "sthubei",
            "otaokexing",
            "unknown",
            "write c",
            "outaokexing",
            "cntaokexing",
            "ms windows",
            "pe32",
            "win64",
            "write",
            "next",
            "win32",
            "malware",
            "copy",
            "keyword tool",
            "historical ssl",
            "referrer",
            "vs2010",
            "file",
            "sections",
            "signature",
            "file version",
            "windows system",
            "internal name",
            "version",
            "portable",
            "info compiler",
            "analyzer paste",
            "iocs",
            "url https",
            "samples",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "heur",
            "malware site",
            "malicious site",
            "iframe",
            "alexa",
            "deepscan",
            "crack",
            "fusioncore",
            "cleaner",
            "riskware",
            "jakyllhyde",
            "china unknown",
            "asnone china",
            "cname",
            "as4812 china",
            "as4134 chinanet",
            "date",
            "moved",
            "search",
            "status",
            "body",
            "as4837 china",
            "bad request",
            "passive dns",
            "gmt content",
            "type",
            "scan endpoints",
            "all scoreblue",
            "twitter",
            "trojan",
            "urls",
            "machinename",
            "alibaba cloud",
            "computing",
            "beijing",
            "domains",
            "contacted",
            "ip detections",
            "country",
            "files",
            "file type",
            "signals mutexes",
            "local",
            "localc",
            "mutexes",
            "as31122 digiweb",
            "ireland unknown",
            "a domains",
            "gmt server",
            "pulse pulses",
            "pragma",
            "ipv4",
            "apache",
            "get http",
            "request",
            "host",
            "accept",
            "response",
            "date mon",
            "http requests",
            "connection",
            "server",
            "pluginrun",
            "ip traffic",
            "hashes",
            "user",
            "dns resolutions",
            "ff ff",
            "lowdatetime",
            "mofresourcename",
            "portclsmof",
            "hdaudiomofname",
            "processorwmi",
            "acpimofresource",
            "mofresource",
            "registry keys",
            "counter",
            "files written",
            "files dropped",
            "registry",
            "samplepath",
            "windir",
            "created c",
            "shell commands",
            "monitor",
            "arg0",
            "tree",
            "synchronization",
            "yara signature",
            "match",
            "thor apt",
            "scanner rule",
            "livehunt",
            "ruletype",
            "rule feed",
            "rulelink",
            "microsoft",
            "ruleauthor",
            "backdoor",
            "injection",
            "sabey data centers",
            "vbs",
            "remote attack",
            "extreme targeting",
            "116.207.118.87",
            "192.168.56.103",
            "linux",
            "locate linux deployed",
            "track",
            "tracking",
            "track all devices",
            "android",
            "apple",
            "apple webkit"
          ],
          "references": [
            "Win32/JakyllHyde - RUNDLL32.EXE FileHash-SHA1 01021c698664f7567b787d7bce266124ec0a226fb2e586125d109beb0ad0ba17",
            "Found in a malicious keyword index: http://m.xiang5.com/keyword/17655.html&htE5-: Family",
            "IDS Detections: Win32/JakyllHyde C2 Activity Win32/JakyllHyde C2 Activity M2 PE EXE or DLL Windows file download HTTP",
            "Alerts: dead_host injection_runpe network_icmp allocates_execute_remote_process disables_proxy injection_modifies_memory modifies_proxy_wpad",
            "Alerts: origin_langid multiple_useragents process_interest recon_beacon injection_resumethread antivm_vmware_in_instruction dumped_buffer network_bind network_http allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
            "Trojan:Win32/JakyllHyde:  CnC IP's -183.95.89.203 116.211.100.182 Exploit Source: IPv4 116.207.118.87 163.171.134.109",
            "Trojan:Win32/JakyllHyde: FileHash-SHA256 01021c698664f7567b787d7bce266124ec0a226fb2e586125d109beb0ad0ba17 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA256 37a641988cfb33066c12b68b23bec0623e3d0715d21d6e3b7304bdd7238c8790 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA256 002d9916a54c7ea70c931dca29c0a4500020d8040b9e446a5472b9089c29c8bc - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA256 440165588e14516e1ef13b6240aad27a0e8c49744c8383590425b3cc9d7f23f1 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA256 47d9e427da3dfe5253d0047c40fb773db59dbccb0ff650e86ce7490b2c520c2d - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA256 7512f88162744b57efd14cc5fb98bc7cf5588fa25c218a1e92fe8048932450a8 -trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 0c795954123ebf1806cdafef2b66322f8d40d3ac - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 f971b96cd514dc62a43b51f32e3a440fe3e0c6d4 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 732198087c6a88afa356ea729bd3b8bb16c41901 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 f02ebf4d8955c363d615a53cc44b048d75b7cefb - adware",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 800c8a5f93b04d6c5dc491ab582cd75165918f5f - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 b45c02987811425c672f56e011f394f94cc29a7b - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-SHA1 be97e5638139ee689312e23022d2e55e58d123c6 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: 0dd69941b0f01d1ee4d49c228f832bed - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: 2f237a35379a5fa46168e3a01667f32c - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: 35fc2b92d534f652ffe4ec3cbc3347b6 - adware",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: 4d4cd0582109e110967bce75534031ed -trojan",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: 8eeda8077a13f12aa72c8b7b5f457734 -trojan",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: d6d906a1c4061d3f41053b4548c7ea69 - trojan",
            "Trojan:Win32/JakyllHyde: FileHash-MD5: fa7d0ef6c2c634e4f0e890c3d5b4cf4f - trojan",
            "YARA Signature Match - THOR APT Scanner: RULE_TYPE: Valhalla Rule Feed Only \u26a1",
            "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/Malformed_Copyright_Statements RULE_AUTHOR: Florian Roth",
            "DESCRIPTION: Detects malformed Microsoft copyright statements in executables RULE_AUTHOR: Florian Roth",
            "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/Malformed_Copyright_Statements RULE_AUTHOR: Florian Roth",
            "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/ RULE_AUTHOR: Florian Roth",
            "#copyright #statements #malformed_copyright_statements",
            "ETPRO MALWARE Win32/JakyllHyde C2: https://www.joesandbox.com/analysis/754158/0/html",
            "Snort IDS: 2836073 ETPRO MALWARE Win32/JakyllHyde C2 Activity 192.168.2.3:49698 ->",
            "ETPRO MALWARE Win32/JakyllHyde C2 Activity M2 - Source IP: 116.211.100.21 - Destination IP: 192.168.2.3",
            "ETPRO MALWARE Win32/JakyllHyde C2 Activity - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
            "ET MALWARE Win32/Eyoorun.D Variant Checkin - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
            "ETPRO MALWARE Win32/JakyllHyde C2 Activity - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
            "ET MALWARE Win32/Eyoorun.D Variant Checkin - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
            "ET TROJAN W32/Witch.3FA0!tr CnC Actiivty M2 - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
            "ETPRO MALWARE Win32/JakyllHyde C2 Activity M2 - Source IP: 116.211.100.21 - Destination IP: 192.168.2.3",
            "System process connects to network (likely due to code injection or exploit)",
            "Snort IDS alert for network traffic | Detected VMProtect packer",
            "W32/Witch.3FA0!tr: FileHash-MD5 38be6c6b799140f435bc1b1d42275d7c",
            "W32/Witch.3FA0!tr: FileHash-SHA1 13ed578302cc1f302a8a9df9308859486aeb4d0b",
            "W32/Witch.3FA0!tr: 601928c4508162aed7491ea4995eca7361be6faeac3c06ee5fc5302e686e26448",
            "http://tuijian.adhei.com/douyu/v1/encrypt/gamebox_m.cs",
            "http://tuijian.adhei.com/douyu/v1/encrypt/gamebox_m.css",
            "http://tuijian.adhei.com/douyu/v /encrypt/gamebox_m.css",
            "http://ssp.1rtb.com/imp?ua=Mozilla/5.0+(Linux;+U;+Android+4.3.1;+en-us;+GT-I8190+Build/JZO54K)+AppleWebKit/534.30+",
            "http://57d7.zhanyu66.com/air.thinlinuxforandroid.apk",
            "http://sdk.1rtb.com/sdk/req_ad?app_package=com.scpp.plus&device_type=1&device_adid=92841014150fc3fd&device_geo_lat=&app_name=%E8%B",
            "http://ssp.1rtb.com/tracker?ua=Mozilla/5.0+(Linux;+Android+7.1.2;+SM-T555+Build/NMF26X;+wv)+AppleWebKit/537.36+(KHTML,+like+Gecko)",
            "https://simulator-api.666phonemanager.com/advert/gamebox_winpop/online",
            "http://ssp.1rtb.com/imp?ua=Mozilla/5.0+(Linux;+Android+7.1.2;+SM-T555+Build/NMF26X;+wv)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Version/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "China",
            "Hong Kong",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/JakyllHyde",
              "display_name": "Trojan:Win32/JakyllHyde",
              "target": "/malware/Trojan:Win32/JakyllHyde"
            },
            {
              "id": "SecuriteInfo.com.Trojan.GenericKD.32885218.16582.30886.dll",
              "display_name": "SecuriteInfo.com.Trojan.GenericKD.32885218.16582.30886.dll",
              "target": null
            },
            {
              "id": "W32/Witch.3FA0!tr",
              "display_name": "W32/Witch.3FA0!tr",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1037",
              "name": "Boot or Logon Initialization Scripts",
              "display_name": "T1037 - Boot or Logon Initialization Scripts"
            },
            {
              "id": "T1037.001",
              "name": "Logon Script (Windows)",
              "display_name": "T1037.001 - Logon Script (Windows)"
            },
            {
              "id": "T1037.002",
              "name": "Logon Script (Mac)",
              "display_name": "T1037.002 - Logon Script (Mac)"
            },
            {
              "id": "T1037.003",
              "name": "Network Logon Script",
              "display_name": "T1037.003 - Network Logon Script"
            },
            {
              "id": "T1003.001",
              "name": "LSASS Memory",
              "display_name": "T1003.001 - LSASS Memory"
            },
            {
              "id": "T1003.003",
              "name": "NTDS",
              "display_name": "T1003.003 - NTDS"
            },
            {
              "id": "T1003.002",
              "name": "Security Account Manager",
              "display_name": "T1003.002 - Security Account Manager"
            },
            {
              "id": "T1003.004",
              "name": "LSA Secrets",
              "display_name": "T1003.004 - LSA Secrets"
            },
            {
              "id": "T1406",
              "name": "Obfuscated Files or Information",
              "display_name": "T1406 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1021.001",
              "name": "Remote Desktop Protocol",
              "display_name": "T1021.001 - Remote Desktop Protocol"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1039",
              "name": "Data from Network Shared Drive",
              "display_name": "T1039 - Data from Network Shared Drive"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 682,
            "FileHash-SHA1": 327,
            "FileHash-SHA256": 2911,
            "SSLCertFingerprint": 4,
            "URL": 13039,
            "domain": 1038,
            "hostname": 2764,
            "email": 2,
            "CVE": 2
          },
          "indicator_count": 20769,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85e73efe2e053366ed972",
          "name": "https://www.hallrender.com/attorney/brian-sabey/",
          "description": "",
          "modified": "2024-09-05T06:21:34.047000",
          "created": "2024-01-30T02:26:59.218000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "sample",
            "ssl certificate",
            "feeds ioc",
            "analyze",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted urls",
            "august",
            "execution",
            "njrat",
            "ransomware",
            "gopher",
            "formbook",
            "whois ssl",
            "communicating",
            "obz4usfn0 url",
            "cfqirgdhj5 url",
            "obz4usfn0",
            "sfqh4dt74w0 url",
            "cfqirgdhj5",
            "localappdata",
            "temp",
            "getprocaddress",
            "windir",
            "ascii text",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "path",
            "factory",
            "hybrid",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers date",
            "gmt connection",
            "obz4usfn0 http",
            "cfqirgdhj5 http",
            "bundled",
            "dropped",
            "putty",
            "february",
            "july",
            "whois whois",
            "malware",
            "urls",
            "post",
            "vj87",
            "passive dns",
            "http",
            "unique",
            "ukhdaauqaaaaaac",
            "screenshot",
            "scan endpoints",
            "all octoseek",
            "code"
          ],
          "references": [
            "https://www.hallrender.com/attorney/brian-sabey/",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "business-support.intel.com",
            "00000000000.cloudfront.net",
            "mobileaccess.intel.com",
            "artificial-legal-intelligence.com",
            "http://intel.net/.about.html",
            "http://medlineplus.gov.https.sci-hub.st",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "http://pl.gov-zaloguj.info",
            "http://apple.helptechnicalsupport.com/favicon.ico",
            "https://www.journaldev.com/41403/regex"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Gopher",
              "display_name": "Gopher",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Ascii Exploit",
              "display_name": "Ascii Exploit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "658b74ee93a0b0dc9c960cee",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 184,
            "FileHash-SHA1": 168,
            "FileHash-SHA256": 6145,
            "URL": 14252,
            "hostname": 4778,
            "domain": 6809,
            "CVE": 3
          },
          "indicator_count": 32339,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665bb7679843a6dabe4560e3",
          "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
          "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
          "modified": "2024-09-05T06:11:17.325000",
          "created": "2024-06-02T00:05:59.160000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 2008,
            "URL": 11241,
            "domain": 1853,
            "hostname": 4198,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 19615,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6674e062afd192ab545b1a04",
          "name": "Lazarus Group",
          "description": "Everyone? Why Brashears? You are all so brilliant! It's not to surprising. I acted on behalf of target to follow your report. I am not anywhere close to ever being as clever as thee. Are you hiring snoops? This took form in October 2013.\nThen a follower. Next hell week-years. Just because you can. Well toasts yourselves. It must be amazing to be able to live without the fear of consequences, with knowledge that you're probably right. You know the odds or even better, the government pays you to do it!\nI am truly fascinated as well as humbled by your abilities. You made her so very sad. If that's what you need. Really rethink you choices, it's so otherworldly; again making you all so \nbright. She's met some of you, spoken to some of you, shopped alongside, was surveilled, viewed. More popular than the Kardashian on your rogue channels. Now THAT'S Reality TV. Bieber & Tori Kelley got her song chops, Sony was hacked. Okay. I'm so impressed, Hire me.\n\nsmph. I don't get it. No one does. \nAll tags auto generated.",
          "modified": "2024-09-05T06:06:53.933000",
          "created": "2024-06-21T02:07:30.790000",
          "tags": [
            "scripts",
            "redline stealer",
            "lazarus",
            "core",
            "no problems",
            "html internet",
            "html document",
            "ascii text",
            "language",
            "merkd1904",
            "code",
            "c++"
          ],
          "references": [],
          "public": 1,
          "adversary": "Lazarus Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "204.79.197.200",
              "display_name": "204.79.197.200",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6840,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "FileHash-MD5": 50,
            "FileHash-SHA1": 43,
            "FileHash-SHA256": 850,
            "URL": 949,
            "domain": 141,
            "hostname": 410
          },
          "indicator_count": 2445,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653a092e3e9270a3ccff2aa0",
          "name": "Apple iOS compromise. CVE Jar",
          "description": "ASpeakSoft iOS iPhone Unlocker v1.0.36 Multilingual Portable.exe\nTargets Tsara Brashears iPhone unlocked, Total command and control. Dumping, remote access, hidden users, privilege escalation,  malware spreading, tracking, defacement, libel, harassment. \n\nTarget at eminent risk",
          "modified": "2024-08-28T12:01:51.699000",
          "created": "2023-10-26T06:37:34.613000",
          "tags": [
            "apple ios",
            "tsara brashears",
            "unlocker",
            "critical risk",
            "cyberstalking",
            "elf collection",
            "apple phone",
            "shell code",
            "script",
            "spyware",
            "hacktool",
            "installer",
            "banker",
            "keylogger",
            "name verdict",
            "falcon sandbox",
            "beginstring",
            "sha256",
            "sha1",
            "runtime process",
            "segoe ui",
            "internet",
            "null",
            "size",
            "misc attack",
            "unknown",
            "error",
            "span",
            "date",
            "body",
            "refresh",
            "class",
            "generator",
            "critical",
            "tools",
            "look",
            "verify",
            "restart",
            "hybrid",
            "general",
            "click",
            "strings",
            "meta",
            "hiddentears",
            "PyInstaller",
            "ransomware",
            "verified",
            "et",
            "legal entities",
            "phishing",
            "e-devlet",
            "buff achievement tracker",
            "cyber warfare",
            "malware",
            "ransom",
            "malware spreader",
            "et malware",
            "neurevt.a.betabot check in",
            "atlassian",
            "Tulach malware",
            "shell code script",
            "TrojanSpy",
            "remote access",
            "cve",
            "collection",
            "monitoring",
            "cyber threat",
            "cyber stalking",
            "cybercrime",
            "lockbin.1",
            "python connection",
            "elf",
            "redirect",
            "watchhers",
            "tracking",
            "fed",
            "us",
            "blob",
            "vortex",
            "Amazon aes",
            "spyware",
            "banker",
            "synaptics",
            "fraud service",
            "python initiated connection",
            "Trojan_Win_Generic_101",
            "malware trojan",
            "evader",
            "contacted",
            "execution",
            "cobaltstrike",
            "hacking_tool",
            "trojan",
            "cve exploit",
            "red team tools",
            "fireeye",
            "noname057",
            "adult content",
            "pornographer",
            "attack",
            "unsafe",
            "tulach malware",
            "remote attacks",
            "Rat"
          ],
          "references": [
            "1.116.132.182/weblogic_CVE_2020_2551.jar",
            "http://1.116.132.182/.git/HEAD"
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Colbalt Strike",
              "display_name": "Colbalt Strike",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            },
            {
              "id": "trojan.barys/cobalt",
              "display_name": "trojan.barys/cobalt",
              "target": null
            },
            {
              "id": "NoName057",
              "display_name": "NoName057",
              "target": null
            },
            {
              "id": "Network RAT",
              "display_name": "Network RAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1445",
              "name": "Abuse of iOS Enterprise App Signing Key",
              "display_name": "T1445 - Abuse of iOS Enterprise App Signing Key"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1493",
              "name": "Transmitted Data Manipulation",
              "display_name": "T1493 - Transmitted Data Manipulation"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1088",
              "name": "Bypass User Account Control",
              "display_name": "T1088 - Bypass User Account Control"
            },
            {
              "id": "T1583.002",
              "name": "DNS Server",
              "display_name": "T1583.002 - DNS Server"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 99,
            "FileHash-SHA1": 92,
            "FileHash-SHA256": 984,
            "URL": 2184,
            "domain": 274,
            "hostname": 782,
            "CVE": 10
          },
          "indicator_count": 4425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "599 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5c5ebba25ca46fc5b36bc",
          "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:11:39.752000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "msie",
            "chrome",
            "certificate",
            "hostname",
            "url analysis",
            "http response",
            "final url",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers date",
            "connection",
            "date sat",
            "html info",
            "forbidden",
            "google tag",
            "utc aw741566034",
            "utc redirection",
            "asnone united",
            "as54113",
            "cname",
            "script urls",
            "as19527 google",
            "as35280 acorus",
            "encrypt",
            "reverse dns",
            "location dublin",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "as4808 china",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "tulach",
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "social engineering",
            "contact made by mark brian sabey",
            "contact made by o'dea",
            "benjamin c"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4655,
            "URL": 9981,
            "FileHash-MD5": 219,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 6722,
            "hostname": 4341,
            "CVE": 2,
            "email": 12,
            "BitcoinAddress": 3
          },
          "indicator_count": 26148,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "753 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbadc21b9891c459b9d2",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:13.975000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9995,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "753 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbbbcb7a479db222f053",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:27.745000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9996,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 26000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "753 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65aa168aeddea4851fc47cc3",
          "name": "Zerobot & Skynet",
          "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
          "modified": "2024-03-23T01:01:38.014000",
          "created": "2024-01-19T06:28:26.343000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 78,
            "FileHash-SHA1": 78,
            "FileHash-SHA256": 2290,
            "domain": 1491,
            "hostname": 2611,
            "URL": 5879,
            "CVE": 8
          },
          "indicator_count": 12435,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "757 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c91f2b7c03b480379ae4d1",
          "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender",
          "description": "1st time researching https://house.mo.gov/ & house.mo.gov. False arrest records of a target originated from Missouri. A glitch delete pulses & references in bulk.\nPegasus is the should be illegal. Destroying evidence of a truth that would be believed if heard. Spying for dirt to discredit. Target heavily deterred by cyber warfare,  healthcare fraud, injuries, financial difficulties due to hacked away businesses, strange shadowy government abused, in person stalking, threats and physical attacks, denied disability with a spinal cord injury?\nhttps://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
          "modified": "2024-03-12T15:03:06.954000",
          "created": "2024-02-11T19:25:31.451000",
          "tags": [
            "united",
            "as393601 state",
            "a domains",
            "passive dns",
            "as397241",
            "certificate",
            "urls",
            "search",
            "showing",
            "entries",
            "algorithm",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "global g2",
            "tls rsa",
            "sha256",
            "ca1 odigicert",
            "info",
            "record type",
            "ttl value",
            "all txt",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "resolutions",
            "historical ssl",
            "communicating",
            "problems",
            "parent domain",
            "njrat",
            "ransomware",
            "startpage",
            "historical",
            "malware",
            "execution",
            "threat roundup",
            "april",
            "september",
            "remcos rat",
            "august",
            "june",
            "qakbot",
            "push",
            "service",
            "privateloader",
            "amadey",
            "powershell",
            "qbot",
            "cobalt strike",
            "core",
            "hacktool",
            "november",
            "october",
            "roundup",
            "threat network",
            "cellbrite",
            "february",
            "emotet",
            "maze",
            "metro",
            "dark",
            "malicious",
            "team",
            "critical",
            "copy",
            "awful",
            "parallax rat",
            "banker",
            "keylogger",
            "dns replication",
            "date",
            "csc corporate",
            "domains",
            "code",
            "server",
            "registrar abuse",
            "registrar iana",
            "registry domain",
            "registrar url",
            "registrar",
            "contact phone",
            "apple ios",
            "quasar",
            "remcos",
            "ursnif",
            "chaos",
            "ransomexx",
            "azorult",
            "agent tesla",
            "evilnum",
            "asyncrat",
            "win32 exe",
            "wininit",
            "beta version",
            "cmstp",
            "taskscheduler",
            "ieudinit",
            "nat32",
            "certsentry",
            "type name",
            "wc3 rpg",
            "pegasus",
            "unknown",
            "domain",
            "servers",
            "germany unknown",
            "name servers",
            "status",
            "next",
            "as29066 host",
            "as133618",
            "cname",
            "as47846",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "encrypt",
            "china unknown",
            "as38365 beijing",
            "as134175 unit",
            "707713",
            "hong kong",
            "virgin islands",
            "as6461 zayo",
            "ransom",
            "exploit",
            "ipv4",
            "pulse submit",
            "url analysis",
            "trojan",
            "body",
            "click",
            "creation date",
            "emails",
            "expiration date",
            "domain privacy",
            "hostname",
            "dynamicloader",
            "state",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "show",
            "slcc2",
            "media center",
            "error",
            "delphi",
            "guard",
            "write",
            "win32",
            "target",
            "redir",
            "facebook",
            "dcom",
            "local",
            "delete",
            "utf8",
            "unicode text",
            "crlf line",
            "rgba",
            "yara detections",
            "default",
            "asnone",
            "get na",
            "dns lookup",
            "probe ms17010",
            "eternalblue",
            "playgame",
            "high",
            "related pulses",
            "yara rule",
            "anomalous file",
            "dynamic",
            "malware infection",
            "cnc",
            "procmem_yara",
            "antivm_generic_disk",
            "modify_proxy infostealer_cookies",
            "network_http",
            "anomalous_deletefile",
            "antidebug_guardpages",
            "powershell_request",
            "powershell_download",
            "as63949 linode",
            "mtb feb",
            "open ports",
            "backdoor",
            "gmt content",
            "trojandropper",
            "simda",
            "lockbit",
            "win.trojan",
            "midia-4",
            "floxif",
            "cryptowall",
            "brontok",
            "check in",
            "record value",
            "files",
            "location united",
            "america asn",
            "as16509",
            "download",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls http",
            "samples",
            "tsara brashears",
            "2nd corintnthians 4:8-9",
            "injection_inter_process",
            "injection_create_remote_thread",
            "persistence_autorun",
            "bypass_firewall",
            "disables_windowsupdate",
            "dynamic_function_loading",
            "http_request",
            "query",
            "delete c",
            "activity dns",
            "components",
            "file execution",
            "observed dns",
            "as4837 china",
            "nxdomain",
            "a nxdomain",
            "wannacry",
            "missouri",
            "safebae",
            "hallrender",
            "house.mo.gov",
            "typosquatting",
            "tactics",
            "google",
            "win64",
            "khtml",
            "gecko",
            "veryhigh",
            "aes256gcm",
            "dalles",
            "cookie",
            "urls https",
            "xpcegvo2adsnq",
            "mhkz",
            "mvi2",
            "keepaliveyes",
            "fexp24007246",
            "nsyt",
            "eva reimer",
            "daisy coleman",
            "brian sabey",
            "https://lawlink.com/documents/10935/blackbag-technologies-announ"
          ],
          "references": [
            "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
            "dns.msftncsi.com",
            "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
            "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "23.216.147.64",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
            "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
            "alohatube.xyz [BotNetwork]",
            "facebooksunglassshop.com",
            "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
            "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
            "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
            "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
            "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
            "remote.utorrent.com [remote router logins]",
            "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
            "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
            "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
            "http://tvm77.fashiongup.in/tracking/track-open",
            "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
            "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
            "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
            "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
            "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
            "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
            "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
            "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
            "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
            "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
            "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
            "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
            "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
            "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
            "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "China",
            "Australia",
            "Hong Kong"
          ],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "AsyncRAT",
              "display_name": "AsyncRAT",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Chaos",
              "display_name": "Chaos",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "EVILNUM",
              "display_name": "EVILNUM",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Keylogger",
              "display_name": "Keylogger",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "Parallax RAT",
              "display_name": "Parallax RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Remcos RAT",
              "display_name": "Remcos RAT",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-336074",
              "display_name": "Win.Trojan.Agent-336074",
              "target": null
            },
            {
              "id": "Arid.Viper_CnC",
              "display_name": "Arid.Viper_CnC",
              "target": null
            },
            {
              "id": "WininiCrypt",
              "display_name": "WininiCrypt",
              "target": null
            },
            {
              "id": "PWS:Win32/QQpass.CI",
              "display_name": "PWS:Win32/QQpass.CI",
              "target": "/malware/PWS:Win32/QQpass.CI"
            },
            {
              "id": "Win.Trojan.Midia-4",
              "display_name": "Win.Trojan.Midia-4",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Win32/SocStealer!rfn",
              "display_name": "Win32/SocStealer!rfn",
              "target": null
            },
            {
              "id": "Backdoor.Win32.Shiz.ufj",
              "display_name": "Backdoor.Win32.Shiz.ufj",
              "target": null
            },
            {
              "id": "Email-Worm.Win32.Brontok.n",
              "display_name": "Email-Worm.Win32.Brontok.n",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 148,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1373,
            "FileHash-SHA1": 1174,
            "FileHash-SHA256": 6417,
            "URL": 4264,
            "domain": 2304,
            "hostname": 2413,
            "CVE": 4,
            "email": 15,
            "CIDR": 1
          },
          "indicator_count": 17965,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "768 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbca54daebb7d2084f350d",
          "name": "Phishing HSBC (identity theft) -  Hijack Execution Flow",
          "description": "Hijack Execution Flow: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
          "modified": "2024-03-02T16:00:27.416000",
          "created": "2024-02-01T16:44:04.317000",
          "tags": [
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist http",
            "hsbc group",
            "phishtank http",
            "phishing hsbc",
            "traffic",
            "tor exit",
            "exit",
            "node tcp",
            "et tor",
            "known tor",
            "tor known",
            "http spammer",
            "node",
            "spammer",
            "malicious",
            "malware",
            "team",
            "download",
            "http response",
            "final url",
            "xamzexpires600",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers",
            "algorithm",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "llc registry",
            "expiry date",
            "date",
            "dns replication",
            "basic",
            "pe32 executable",
            "ms windows",
            "intel",
            "win32 dynamic",
            "link library",
            "os2 executable",
            "clipper dos",
            "executable",
            "pe32",
            "win16 ne",
            "pe32 installer",
            "mitre"
          ],
          "references": [
            "http://www.tripphouse.com/th_ext.php",
            "www.tripphouse.com",
            "https://attack.mitre.org/techniques/T1574/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Phishing HSBC",
              "display_name": "Phishing HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2190,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 775,
            "URL": 2229,
            "domain": 545,
            "hostname": 723,
            "CVE": 1,
            "email": 2
          },
          "indicator_count": 6709,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659d1aa9306d72c1c80b486a",
          "name": "hyundaitx.com | pegasus",
          "description": "",
          "modified": "2024-02-10T15:02:08.842000",
          "created": "2024-01-09T10:06:33.717000",
          "tags": [
            "united",
            "creation date",
            "search",
            "date",
            "expiration date",
            "unknown",
            "as1680 cellcom",
            "israel unknown",
            "as11042 network",
            "scan endpoints",
            "next"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 83,
            "domain": 788,
            "email": 8,
            "hostname": 137,
            "FileHash-MD5": 8,
            "FileHash-SHA1": 8,
            "FileHash-SHA256": 8
          },
          "indicator_count": 1040,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "799 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be8e4a55f5851279c265c8",
          "name": "https://www.hallrender.com/attorney/brian-sabey/ Gopher Ransomware ",
          "description": "",
          "modified": "2024-02-03T19:04:42.251000",
          "created": "2024-02-03T19:04:42.251000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "sample",
            "ssl certificate",
            "feeds ioc",
            "analyze",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted urls",
            "august",
            "execution",
            "njrat",
            "ransomware",
            "gopher",
            "formbook",
            "whois ssl",
            "communicating",
            "obz4usfn0 url",
            "cfqirgdhj5 url",
            "obz4usfn0",
            "sfqh4dt74w0 url",
            "cfqirgdhj5",
            "localappdata",
            "temp",
            "getprocaddress",
            "windir",
            "ascii text",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "path",
            "factory",
            "hybrid",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers date",
            "gmt connection",
            "obz4usfn0 http",
            "cfqirgdhj5 http",
            "bundled",
            "dropped",
            "putty",
            "february",
            "july",
            "whois whois",
            "malware",
            "urls",
            "post",
            "vj87",
            "passive dns",
            "http",
            "unique",
            "ukhdaauqaaaaaac",
            "screenshot",
            "scan endpoints",
            "all octoseek",
            "code"
          ],
          "references": [
            "https://www.hallrender.com/attorney/brian-sabey/",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "business-support.intel.com",
            "00000000000.cloudfront.net",
            "mobileaccess.intel.com",
            "artificial-legal-intelligence.com",
            "http://intel.net/.about.html",
            "http://medlineplus.gov.https.sci-hub.st",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "http://pl.gov-zaloguj.info",
            "http://apple.helptechnicalsupport.com/favicon.ico",
            "https://www.journaldev.com/41403/regex"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Gopher",
              "display_name": "Gopher",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Ascii Exploit",
              "display_name": "Ascii Exploit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b85e73efe2e053366ed972",
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 184,
            "FileHash-SHA1": 168,
            "FileHash-SHA256": 6027,
            "URL": 13374,
            "hostname": 4575,
            "domain": 6755,
            "CVE": 3
          },
          "indicator_count": 31086,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "806 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85e7056e146f1416eae32",
          "name": "https://www.hallrender.com/attorney/brian-sabey/",
          "description": "",
          "modified": "2024-01-30T02:26:56.698000",
          "created": "2024-01-30T02:26:56.698000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "sample",
            "ssl certificate",
            "feeds ioc",
            "analyze",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted urls",
            "august",
            "execution",
            "njrat",
            "ransomware",
            "gopher",
            "formbook",
            "whois ssl",
            "communicating",
            "obz4usfn0 url",
            "cfqirgdhj5 url",
            "obz4usfn0",
            "sfqh4dt74w0 url",
            "cfqirgdhj5",
            "localappdata",
            "temp",
            "getprocaddress",
            "windir",
            "ascii text",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "path",
            "factory",
            "hybrid",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers date",
            "gmt connection",
            "obz4usfn0 http",
            "cfqirgdhj5 http",
            "bundled",
            "dropped",
            "putty",
            "february",
            "july",
            "whois whois",
            "malware",
            "urls",
            "post",
            "vj87",
            "passive dns",
            "http",
            "unique",
            "ukhdaauqaaaaaac",
            "screenshot",
            "scan endpoints",
            "all octoseek",
            "code"
          ],
          "references": [
            "https://www.hallrender.com/attorney/brian-sabey/",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "business-support.intel.com",
            "00000000000.cloudfront.net",
            "mobileaccess.intel.com",
            "artificial-legal-intelligence.com",
            "http://intel.net/.about.html",
            "http://medlineplus.gov.https.sci-hub.st",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "http://pl.gov-zaloguj.info",
            "http://apple.helptechnicalsupport.com/favicon.ico",
            "https://www.journaldev.com/41403/regex"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Gopher",
              "display_name": "Gopher",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Ascii Exploit",
              "display_name": "Ascii Exploit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "658b74ee93a0b0dc9c960cee",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 184,
            "FileHash-SHA1": 168,
            "FileHash-SHA256": 6027,
            "URL": 13374,
            "hostname": 4575,
            "domain": 6755,
            "CVE": 3
          },
          "indicator_count": 31086,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "810 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b809ec9da9326e1bdf8743",
          "name": "Pegasus | Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com]",
          "description": "",
          "modified": "2024-01-29T20:26:20.769000",
          "created": "2024-01-29T20:26:20.769000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657feca7df9ea6c21350c01a",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "811 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b809eabd76cbbfdfc07c6e",
          "name": "Pegasus | Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com]",
          "description": "",
          "modified": "2024-01-29T20:26:18.174000",
          "created": "2024-01-29T20:26:18.174000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657feca7df9ea6c21350c01a",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "811 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658ca37e41ea135fa35b8832",
          "name": "Masquerading: https://www.hallrender.com/attorney/brian-sabey/ ",
          "description": "",
          "modified": "2024-01-26T00:00:39.927000",
          "created": "2023-12-27T22:21:50.409000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "sample",
            "ssl certificate",
            "feeds ioc",
            "analyze",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted urls",
            "august",
            "execution",
            "njrat",
            "ransomware",
            "gopher",
            "formbook",
            "whois ssl",
            "communicating",
            "obz4usfn0 url",
            "cfqirgdhj5 url",
            "obz4usfn0",
            "sfqh4dt74w0 url",
            "cfqirgdhj5",
            "localappdata",
            "temp",
            "getprocaddress",
            "windir",
            "ascii text",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "path",
            "factory",
            "hybrid",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers date",
            "gmt connection",
            "obz4usfn0 http",
            "cfqirgdhj5 http",
            "bundled",
            "dropped",
            "putty",
            "february",
            "july",
            "whois whois",
            "malware",
            "urls",
            "post",
            "vj87",
            "passive dns",
            "http",
            "unique",
            "ukhdaauqaaaaaac",
            "screenshot",
            "scan endpoints",
            "all octoseek",
            "code"
          ],
          "references": [
            "https://www.hallrender.com/attorney/brian-sabey/",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "business-support.intel.com",
            "00000000000.cloudfront.net",
            "mobileaccess.intel.com",
            "artificial-legal-intelligence.com",
            "http://intel.net/.about.html",
            "http://medlineplus.gov.https.sci-hub.st",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "http://pl.gov-zaloguj.info",
            "http://apple.helptechnicalsupport.com/favicon.ico",
            "https://www.journaldev.com/41403/regex"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Gopher",
              "display_name": "Gopher",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Ascii Exploit",
              "display_name": "Ascii Exploit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "658b74ee93a0b0dc9c960cee",
          "export_count": 38,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 184,
            "FileHash-SHA1": 168,
            "FileHash-SHA256": 6027,
            "URL": 13374,
            "hostname": 4575,
            "domain": 6755,
            "CVE": 3
          },
          "indicator_count": 31086,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658b74f4a6c53cc8e0f70611",
          "name": "Masquerading: https://www.hallrender.com/attorney/brian-sabey/",
          "description": "A report generated by the MITRE ATT&CK\u2122 security team on 26 December 2023 is published on the website of Brian Sabey, the lawyer who brought the UK government to court.",
          "modified": "2024-01-26T00:00:39.927000",
          "created": "2023-12-27T00:51:00.982000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "sample",
            "ssl certificate",
            "feeds ioc",
            "analyze",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted urls",
            "august",
            "execution",
            "njrat",
            "ransomware",
            "gopher",
            "formbook",
            "whois ssl",
            "communicating",
            "obz4usfn0 url",
            "cfqirgdhj5 url",
            "obz4usfn0",
            "sfqh4dt74w0 url",
            "cfqirgdhj5",
            "localappdata",
            "temp",
            "getprocaddress",
            "windir",
            "ascii text",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "path",
            "factory",
            "hybrid",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers date",
            "gmt connection",
            "obz4usfn0 http",
            "cfqirgdhj5 http",
            "bundled",
            "dropped",
            "putty",
            "february",
            "july",
            "whois whois",
            "malware",
            "urls",
            "post",
            "vj87",
            "passive dns",
            "http",
            "unique",
            "ukhdaauqaaaaaac",
            "screenshot",
            "scan endpoints",
            "all octoseek",
            "code"
          ],
          "references": [
            "https://www.hallrender.com/attorney/brian-sabey/",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "business-support.intel.com",
            "00000000000.cloudfront.net",
            "mobileaccess.intel.com",
            "artificial-legal-intelligence.com",
            "http://intel.net/.about.html",
            "http://medlineplus.gov.https.sci-hub.st",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "http://pl.gov-zaloguj.info",
            "http://apple.helptechnicalsupport.com/favicon.ico",
            "https://www.journaldev.com/41403/regex"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Gopher",
              "display_name": "Gopher",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Ascii Exploit",
              "display_name": "Ascii Exploit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 43,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 184,
            "FileHash-SHA1": 168,
            "FileHash-SHA256": 6027,
            "URL": 13374,
            "hostname": 4575,
            "domain": 6755,
            "CVE": 3
          },
          "indicator_count": 31086,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658b74ee93a0b0dc9c960cee",
          "name": "Masquerading: https://www.hallrender.com/attorney/brian-sabey/",
          "description": "A report generated by the MITRE ATT&CK\u2122 security team on 26 December 2023 is published on the website of Brian Sabey, the lawyer who brought the UK government to court.",
          "modified": "2024-01-26T00:00:39.927000",
          "created": "2023-12-27T00:50:54.481000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "sample",
            "ssl certificate",
            "feeds ioc",
            "analyze",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted urls",
            "august",
            "execution",
            "njrat",
            "ransomware",
            "gopher",
            "formbook",
            "whois ssl",
            "communicating",
            "obz4usfn0 url",
            "cfqirgdhj5 url",
            "obz4usfn0",
            "sfqh4dt74w0 url",
            "cfqirgdhj5",
            "localappdata",
            "temp",
            "getprocaddress",
            "windir",
            "ascii text",
            "mitre att",
            "file",
            "ck id",
            "show technique",
            "path",
            "factory",
            "hybrid",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers date",
            "gmt connection",
            "obz4usfn0 http",
            "cfqirgdhj5 http",
            "bundled",
            "dropped",
            "putty",
            "february",
            "july",
            "whois whois",
            "malware",
            "urls",
            "post",
            "vj87",
            "passive dns",
            "http",
            "unique",
            "ukhdaauqaaaaaac",
            "screenshot",
            "scan endpoints",
            "all octoseek",
            "code"
          ],
          "references": [
            "https://www.hallrender.com/attorney/brian-sabey/",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "business-support.intel.com",
            "00000000000.cloudfront.net",
            "mobileaccess.intel.com",
            "artificial-legal-intelligence.com",
            "http://intel.net/.about.html",
            "http://medlineplus.gov.https.sci-hub.st",
            "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
            "http://pl.gov-zaloguj.info",
            "http://apple.helptechnicalsupport.com/favicon.ico",
            "https://www.journaldev.com/41403/regex"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Gopher",
              "display_name": "Gopher",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Ascii Exploit",
              "display_name": "Ascii Exploit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 184,
            "FileHash-SHA1": 168,
            "FileHash-SHA256": 6027,
            "URL": 13374,
            "hostname": 4575,
            "domain": 6755,
            "CVE": 3
          },
          "indicator_count": 31086,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fed19f6d24e751fa82de8",
          "name": "Lazarus Hosts | https://www.poemhunter.com/tsara-brashears",
          "description": "",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T06:56:25.399000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657fbac9a03d611624985685",
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fbac9a03d611624985685",
          "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
          "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T03:21:45.890000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657fbac7f0d96f1ad5d90ccb",
          "name": "Lazarus Matrix | https://www.poemhunter.com/tsara-brashears",
          "description": "Search content targeting American independent artist & publisher; Tsara Brashears.  was prominently malvertized before being blacklisted for malicious content. Miscellaneous network, libel, tagging, adult content, social engineering, fine deletion , multiple bot networks. Virus network smear campaign launched by Brian Sabey of Hall Render includes; safebae.org, rallypoit.com, Westlaw.com, \n www.poemhunter.com, pornhub.sev. apple.com, nr- data.com, cia.gov+ \n tracking, hacking monitoring, modifying. banking, ddos, ransomware, webcam, medical records, email threats, attempts. Active 'SA' silencecing campaign. Target & associated in danger. \n \nCritical threat to public. Compromised business with more than 2+ million downloads. Downloads amended by hackers, audience deleted.",
          "modified": "2024-01-17T01:04:01.912000",
          "created": "2023-12-18T03:21:43.483000",
          "tags": [
            "ssl certificate",
            "whois record",
            "resolutions",
            "threat roundup",
            "referrer",
            "contacted",
            "april",
            "historical ssl",
            "threat network",
            "june",
            "august",
            "ransomware",
            "malware",
            "python",
            "probe",
            "formbook",
            "dropped",
            "njrat",
            "malware alibaba",
            "cloud computing",
            "service",
            "love",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 152,
            "FileHash-SHA256": 2657,
            "URL": 6244,
            "domain": 1672,
            "hostname": 2213
          },
          "indicator_count": 13091,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "823 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6581d8d30621e6303cad9da4",
          "name": "RallyPoint.com",
          "description": "",
          "modified": "2024-01-16T18:00:08.947000",
          "created": "2023-12-19T17:54:27.416000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657f69115e6b1bdc8a7dcdbc",
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657feca7df9ea6c21350c01a",
          "name": "Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com] ",
          "description": "",
          "modified": "2024-01-16T18:00:08.947000",
          "created": "2023-12-18T06:54:31.063000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657f6b136775cbf67d25ddfb",
          "export_count": 34,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657f6b136775cbf67d25ddfb",
          "name": "Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com] Alias Brian Sabey?",
          "description": "",
          "modified": "2024-01-16T18:00:08.947000",
          "created": "2023-12-17T21:41:39.434000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "657f69115e6b1bdc8a7dcdbc",
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657f6920d79aa646c2d5db49",
          "name": "RallyPoint.com",
          "description": "MyPublicWiFi.exe\nRallyPoint.com",
          "modified": "2024-01-16T18:00:08.947000",
          "created": "2023-12-17T21:33:20.787000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657f6919cafcba3ac406d5b2",
          "name": "RallyPoint.com",
          "description": "MyPublicWiFi.exe\nRallyPoint.com",
          "modified": "2024-01-16T18:00:08.947000",
          "created": "2023-12-17T21:33:13.375000",
          "tags": [
            "united",
            "unknown",
            "as13335",
            "search",
            "showing",
            "aaaa",
            "emails",
            "name servers",
            "servers",
            "as54113",
            "body",
            "date",
            "as15169 google",
            "cname",
            "as393648",
            "moved",
            "creation date",
            "record value",
            "entries",
            "domain related",
            "domains show",
            "asn15169",
            "google",
            "frankfurt",
            "main",
            "germany",
            "http",
            "ashburn",
            "amazonaes",
            "asn16509",
            "facebook",
            "june",
            "general full",
            "url https",
            "reverse dns",
            "protocol h2",
            "security tls",
            "get h2",
            "software",
            "resource",
            "hash",
            "value",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "december",
            "variables",
            "paq object",
            "piwik",
            "matomo",
            "article",
            "join url",
            "facebook url",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "ip detail",
            "domains domain",
            "tree links",
            "certs frames",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "malware",
            "heur",
            "malware site",
            "malicious site",
            "million",
            "phishing site",
            "phishing",
            "unsafe",
            "applicunwnt",
            "artemis",
            "riskware",
            "revenue service",
            "iframe",
            "downldr",
            "agent",
            "presenoker",
            "vidar",
            "alexa",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "urls http",
            "njrat",
            "ransomware",
            "communicating",
            "referrer",
            "whois whois",
            "hostname",
            "hostnames",
            "ip address",
            "javascript",
            "detections type",
            "name",
            "win32 exe",
            "email holokaust",
            "android",
            "files",
            "android file",
            "domains",
            "hashes",
            "westlaw njrat",
            "whois",
            "collections",
            "contacted",
            "pe resource",
            "threat roundup",
            "january",
            "collection",
            "august",
            "lolkek",
            "installer",
            "hacktool",
            "emotet",
            "lazarus",
            "makop",
            "core"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 97,
            "URL": 15233,
            "domain": 3362,
            "email": 14,
            "hostname": 5001,
            "FileHash-SHA256": 2750,
            "CVE": 5
          },
          "indicator_count": 26611,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.tripphouse.com/th_ext.php",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "Malicious Score: 10",
        "TrojanClicker:Win32/Ellell.A: 4d3e7d486ec5918d91e54e51c4d07dc6",
        "Backdoor:Win32/Fynloski.A: FileHash-MD5 c3113684e8f8aa6d1b1b67d59141e845",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "message.htm.com [ message stealer]",
        "Roksit.net",
        "Alerts: procmem_yara injection_inter_process creates_largekey network_bind persistence_autorun injection_process_hollowing",
        "Malicious revenge malvertizing: https://www.milehighmedia.com/legal/2257",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "Hallrender.com and Westlaw.com.= http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://otx.alienvault.com/indicator/url/http://manage.netflix.com.usermanagement.key.1973573.net-server1.com",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "http://apple-unlocked-login.usa.cc/\t| http://apple.com.locked-account-verify-login.usa.cc/",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/Malformed_Copyright_Statements RULE_AUTHOR: Florian Roth",
        "https://www.nsogroup.com",
        "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
        "PWS:Win32/VB : FileHash-SHA256 dbc78d07e96562c6370ab515f5d65cea88a1b163ad10718c66d15155f4075630",
        "Snort IDS: 2836073 ETPRO MALWARE Win32/JakyllHyde C2 Activity 192.168.2.3:49698 ->",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu    (phishing | cybercrime)",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
        "Trojan:Linux/Xorddos: FileHash-SHA256 0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "applepaydayloans.com",
        "http://web2.westlaw.com/ (redirect) https://signon.thomsonreuters.com/?productid=CBT&lr=0&culture=en-US&returnto=https%3a%2f%2f1.next.westlaw.com%...",
        "my.mintmobile.com",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 f02ebf4d8955c363d615a53cc44b048d75b7cefb - adware",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "http://45.159.189.105/bot/regex            (Bot Command)",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "http://ssp.1rtb.com/tracker?ua=Mozilla/5.0+(Linux;+Android+7.1.2;+SM-T555+Build/NMF26X;+wv)+AppleWebKit/537.36+(KHTML,+like+Gecko)",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
        "Trojan:Win32/Zombie.A: FileHash-SHA1 de974c697f0401d681e1bb3c8694a663e9e43d8f",
        "Trojan:Win32/QQpass: FileHash-SHA256 86df64999ed25a02debca89a586c931b0f32b1edc0e7aa800c360be3ef456439",
        "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://nudeteenporn.site",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://support.Apple.com/de",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 732198087c6a88afa356ea729bd3b8bb16c41901 - trojan",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Trojan:Linux/Xorddos:  FileHash-SHA1 a5780498e6fce5933a7e7bf59a6fa5742e97f559",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "ETPRO MALWARE Win32/JakyllHyde C2 Activity - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
        "espysite.azurewebsites.net - https://otx.alienvault.com/indicator/hostname/espysite.azurewebsites.net",
        "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
        "7cwork.a-poster.info a-poster.info: members.a-poster.info work.a-poster.info a-poster.info: http://20work.a-poster.info a-poster.info:",
        "training001.blackbagtech.com [opportunity?]",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: 0dd69941b0f01d1ee4d49c228f832bed - trojan",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "ETPRO MALWARE Win32/JakyllHyde C2 Activity M2 - Source IP: 116.211.100.21 - Destination IP: 192.168.2.3",
        "https://apple.pantion.top/",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Yara Defections: ConventionEngine_Keyword_Install Alerts PlugX",
        "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
        "https://hybrid-analysis.com/sample/86479bf7c9a675913b93a0d399f5cbe0c0e8003239e93ae5e00f97cdbc5ec5ba/5c5c13577ca3e12626364777",
        "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "Alerts: procmem_yara persistence_autorun modify_proxy disables_power_options",
        "iobit: https://cracxfree.com/iobit-malware-fighter-pro-2/http://activationskey.net/wp-content/uploads/2021/02/download-2-7.jpg",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
        "https://otx.alienvault.com/indicator/ip/63.141.242.45",
        "https://b.link/infringement",
        "TrojanDropper:Win32/Muldrop: FileHash-SHA256  bf8e919cf6ce208f1c2f98f07df835099f14e2f8708197b0165479468079d902",
        "http://schemas.microsoft.com/SMI/2016/WindowsSettings",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA1 57486d33246bce6dfedb0836cd97c9acd4a4a39a",
        "remote.utorrent.com [remote router logins]",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: 4d4cd0582109e110967bce75534031ed -trojan",
        "Poemhunter.com + rally point.com = pornhub.dev",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
        "Snort IDS alert for network traffic | Detected VMProtect packer",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Worm:Win32/Fasong: FileHash-SHA256  c7f2f4a6ed374bac385fa81177967fd013248652556e4ee95cea7f064f6b25dd",
        "http://ww1.tsx.org/_fd",
        "http://cracx.net/fonepaw-iphone-data-recovery-3-8-0-crack/ | Malware: 74.208.236.140 malacrack.org ns2.filescrack.com ns1.filescrack.com",
        "init-p01st.push.apple.com",
        "https://simulator-api.666phonemanager.com/advert/gamebox_winpop/online",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "Vtapi: scanter.comwww.twitter.comx.com",
        "http://ssp.1rtb.com/imp?ua=Mozilla/5.0+(Linux;+U;+Android+4.3.1;+en-us;+GT-I8190+Build/JZO54K)+AppleWebKit/534.30+",
        "stagelight.pl                                                 (malicious/ pattern match)",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "ET MALWARE Win32/Eyoorun.D Variant Checkin - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
        "happyrabbit.kr [Apple iOS threat]",
        "IDS Detections: W32/Bayrob Attempted Checkin 2 Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
        "https://applepaydayloans.com/",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "Malware Host: HallRender.com",
        "pw-90cc2fc574f6dd6dccf2c3531928b039@privacyguardian.org | https://crackedvst.info/antares-autotune-pro-crack/",
        "facebooksunglassshop.com",
        "Brian Sabey Jeffrey Scott Reimer DPT Eva Lisa Reimer RN & Quasi Government Insurance companies unwilling to pay for critical assault injuries SCI",
        "alohatube.xyz [BotNetwork]",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "CVE-2023-4966",
        "https://otx.alienvault.com/indicator/file/251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "W32/Witch.3FA0!tr: FileHash-SHA1 13ed578302cc1f302a8a9df9308859486aeb4d0b",
        "iobit: https://cracxfree.com/iobit-malware-fighter-pro-2/ | https://cracklink.info/iobit-uninstaller-pro-key/",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
        "W32/Witch.3FA0!tr: 601928c4508162aed7491ea4995eca7361be6faeac3c06ee5fc5302e686e26448",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "Trojan:Linux/Xorddos: FileHash-MD5 3b4ce1333614cd21c109054630e959b9",
        "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://hallrender.com/attorney/brian-sabey",
        "https://hybrid-analysis.com/sample/ba72877899dffe3cfb08ab3b61d24e45325f0c27f3cec81e88e9dcf3f84f7098",
        "riverside.rocks (safebae.com remote uTorrent) https://hybrid-analysis.com/sample/11108ef17bd75f36e0d22d95b1f3bde3e9fa968a78a24c2d2508f4238e22651d/6326a50be4a8a71b885f5bf3",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Win32:CrypterX-gen\\ [Trj]: FileHash-SHA256 002ea0849da3c63ce6c09c084567e9470c3616084ef19402316e9d52f35c62a7",
        "iobit: https://ezcrack.info/iobit-uninstaller-pro-crack | https://ezcrack.info/iobit-uninstaller-pro-crack/",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 | itunes.apple.com",
        "PWS:Win32/QQpass.B!MTB: FileHash-MD5 f7c36b4e5b4b09dc369163377aade2d7",
        "Pornhub dev VT community: https://www.virustotal.com/gui/domain/pornhub.dev/community",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: d6d906a1c4061d3f41053b4548c7ea69 - trojan",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "IDS Detections: Win32/JakyllHyde C2 Activity Win32/JakyllHyde C2 Activity M2 PE EXE or DLL Windows file download HTTP",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "Trojan:Win32/JakyllHyde: FileHash-SHA256 01021c698664f7567b787d7bce266124ec0a226fb2e586125d109beb0ad0ba17 - trojan",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "deviceinbox.com [malware hosting]",
        "#LowFiCreateRemoteThread:  FileHash-SHA256  0ab94d890afef8ebae42007a119a8686f71bdd9bdf357262481daa7c9c7a283e",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "Alerts: persistence_autorun_tasks spawns_dev_util cape_detected_threat deletes_executed_files suricata_alert",
        "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256 aa289c89f2cdbfe896f4c77c611d94aa95858797014b57e24d5fe2bb0997d7b0",
        "aeuwa03.devtest.call2.team | mike@softwarezpro1.txt  | softwarezpro.net | www.softwarezpro.net | mike@ hijacked targets device Attacked!",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "firebaseremoteconfig.googleapis.com     (remote hacking)",
        "YARA Signature Match - THOR APT Scanner: RULE_TYPE: Valhalla Rule Feed Only \u26a1",
        "ETPRO MALWARE Win32/JakyllHyde C2: https://www.joesandbox.com/analysis/754158/0/html",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "boostmobile.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "https://www.hallrender.com/wp-content/themes/Hall-Render/assets/icons/apple-touch-icon-76x76.png",
        "RASMONTR.DLL 192.168.56.101",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://urlscan.io/result/2285cee3-1e08-4e63-b48f-ee685e008480/#summary",
        "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
        "1.116.132.182/weblogic_CVE_2020_2551.jar",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 f971b96cd514dc62a43b51f32e3a440fe3e0c6d4 - trojan",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Win32/Muldrop FileHash-SHA256 67a5e78bb2897b15d510dfce0d89f60330db01d7944ebb4f1dd90ce36c907e1b",
        "http://intel.net/.about.html",
        "Alerts: antivm_generic_disk antivm_generic_services suspicious_command_tools anomalous_deletefile",
        "http://www.northpoleroute.com/78985064&type=0&resid=5312625",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA256 7456108771e6a8bac658276c1cb9e18c8c348fdd9cd3538419751c3b5ef3ac02",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
        "X Vercel Servers",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "Injected: https://www.google.com/search?q=tsara+brashears&prmd=vni&source=lnms&tbm=vid&sa=X&ved=2ahUKEwimqvSyxKrpAhUHTt8KHReZC7wQ_AUoAXoECAsQAQ&biw=375&bih=544&dpr=3/Malicious-Google-Search-Results-False",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
        "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "DESCRIPTION: Detects malformed Microsoft copyright statements in executables RULE_AUTHOR: Florian Roth",
        "Antivirus Detections: Win.Malware.Shellstartup-9892532-0 ,  Ransom:Win32/LockScreen.BN",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "https://realcrack.info/sidify-apple-music-converter-crack/  | applehouse-jp.com | iappletech.com | http://apple.int-access-accounts.usa.cc/",
        "https://urlscan.io/result/4f0cabbf-9716-47dd-bd5c-038a953e6672/",
        "23.216.147.64",
        "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
        "Ransom:Win32/Haperlock.A; FileHash-SHA256 8264c73f129d4895573c2375ea4e4636b9d5df66852ce72ccc20d31a96ae7df1",
        "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: fa7d0ef6c2c634e4f0e890c3d5b4cf4f - trojan",
        "W32/Witch.3FA0!tr: FileHash-MD5 38be6c6b799140f435bc1b1d42275d7c",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 0c795954123ebf1806cdafef2b66322f8d40d3ac - trojan",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/",
        "http://apple.helptechnicalsupport.com/favicon.ico",
        "TrojanSpy:Win32/Nivdort.DI: FileHash-SHA256 00734b135321562e7e0df7c2f8eb554435cc25c47f46747f79fc2116ac2cc6ef",
        "https://www.poemhunter.com/tsara-brashears/poems/: https://urlscan.io/result/4f0cabbf-9716-47dd-bd5c-038a953e6672/",
        "Alerts: dead_host injection_runpe network_icmp allocates_execute_remote_process disables_proxy injection_modifies_memory modifies_proxy_wpad",
        "Antivirus Detections: ELF:Xorddos-AE\\ [Trj] ,  Unix.Trojan.Xorddos-1 ,",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "https://attack.mitre.org/techniques/T1574/",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: 35fc2b92d534f652ffe4ec3cbc3347b6 - adware",
        "http://1.116.132.182/.git/HEAD",
        "http://appleid.com-index-manager-info-verify-receipt-account.usa.cc/ |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "Alerts: cape_detected_threat cape_extracted_content",
        "http://tuijian.adhei.com/douyu/v1/encrypt/gamebox_m.cs",
        "https://www.roseoubleu.fr/panier        (phishing)",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "dns.msftncsi.com",
        "Mercenary Attackers / Cellebrite branded as: http://teacellertea.com/Pegasus/ NSO",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
        "IDS Detections: Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "remote.telegrafix.com          (remote hacking)",
        "appleid-comloginaccount.info",
        "IDS Detections : Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "Trojan:Win32/JakyllHyde: FileHash-SHA256 002d9916a54c7ea70c931dca29c0a4500020d8040b9e446a5472b9089c29c8bc - trojan",
        "Antivirus Detections: Win.Packer.pkr_ce1a-9980177-0",
        "Alerts: origin_langid multiple_useragents process_interest recon_beacon injection_resumethread antivm_vmware_in_instruction dumped_buffer network_bind network_http allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
        "http://apple-store.jspi304es-services-fixedbilling-responsive-managed-update-card.appleid-storeext.usa.cc/",
        "https://hybrid-analysis.com/sample/8bf763ce9396c4569afbae58392097fd57408339c0ac59ec256468c9fd8ac4c5/6548ebfe56b25bab28017757",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA 453355033bb7977831ca87cc90156b594f13b2ee",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "remote.haverhillcc.com        (remote hacking)",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "http://pl.gov-zaloguj.info",
        "web2.westlaw.com    (redirects to thbrzzrstr.me)",
        "CnC IP's: 192.187.111.221  63.141.242.43  63.141.242.44  63.141.242.46 81.17.18.195  81.17.18.197 81.17.29.146  81.17.29.148",
        "demo.auth.civicalg.com.sni.cloudflaressl.com",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
        "a-fondness-for-beauty.com",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 b45c02987811425c672f56e011f394f94cc29a7b - trojan",
        "https://fixupx.com/Yoda4ever/status/1819058165264404527",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
        "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)",
        "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
        "VirTool:Win32/Obfuscator FileHash-SHA256 874e78143b683016ef8e41977f9d3ee34b97b145b313cdefdeb3e8900db6df73",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "business-support.intel.com",
        "init.ess.apple.com        (remote hacking)",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
        "nr-data.net",
        "http://watchhers.net/index.php",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "Yara Detections: is__elf ,  xorddos ,  LinuxXorDDoS_VariantTwo",
        "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "Parked: www.easycrypto.team | 'Parking Crew' ? Several names exist for advesarial 'Parking Hacker Groups'  parking.namesilo.com",
        "http://www.Apple.com/quicktime/download/standalone.html",
        "Trojan:Win32/Zombie.A: FileHash-MD5 34e85820b41c14e07dd564f22997e893",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "\"Windows SMB Information Disclosure Vulnerability.\" - https://otx.alienvault.com/indicator/cve/CVE-2017-0147",
        "Backdoor:Win32/Botgor: FileHash-SHA256 b70353b3ecf532ad51e7d6a1790275df02c7393b87d40add47a3baccab39802f",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "IDS Detections : AlphaCrypt CnC Beacon 3 MalDoc Request for Payload Aug 17 2016 Koobface W32/Bayrob Attempted Checkin",
        "20work.a-poster.info a-poster.info: 250awork.a-poster.info a-poster.info:  252fwork.a-poster.info a-poster.info:  a-poster.info:",
        "Win.Virus.TeslaCrypt3-2: 78af1fd5be62ab829e49f9a1b5fbb8a9b30f8d0804cba5805c8f350b841d522e",
        "www.softwarezpro.net\thttps://i0.wp.com/softwarezpro.net/wp parking.namesilo.com softwarezpro.org softwarezap.net  softwarezap.net",
        "Yara Detections: osx_GoLang",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: 8eeda8077a13f12aa72c8b7b5f457734 -trojan",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "http://57d7.zhanyu66.com/air.thinlinuxforandroid.apk",
        "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
        "http://tuijian.adhei.com/douyu/v /encrypt/gamebox_m.css",
        "www.metrobyt-mobile.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "TrojanDownloader:Win32/PurityScan.MI!MTB: FileHash-SHA1 58ba8715a88d883537ba8d0e20eea2a4d9269cad",
        "Alerts: deletes_self injection_runpe persistence_ads antisandbox_sleep dead_connect",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
        "Found in a malicious keyword index: http://m.xiang5.com/keyword/17655.html&htE5-: Family",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "www.endgame.com [Threatening] | https://mobisoft.info/dfx-audio-enhancer-crack | https://mobisoft.info/passfab-iphone-unlocker-key",
        "Trojan:Win32/JakyllHyde: FileHash-MD5: 2f237a35379a5fa46168e3a01667f32c - trojan",
        "http://sdk.1rtb.com/sdk/req_ad?app_package=com.scpp.plus&device_type=1&device_adid=92841014150fc3fd&device_geo_lat=&app_name=%E8%B",
        "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/ RULE_AUTHOR: Florian Roth",
        "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
        "Trojan:Win32/Zbot: FileHash-SHA256 b7875b426ce25f1d4785ba7043bbfdba49feb726cc829d681acdd67c3c302c70",
        "Trojan:Win32/JakyllHyde:  CnC IP's -183.95.89.203 116.211.100.182 Exploit Source: IPv4 116.207.118.87 163.171.134.109",
        "http://crackedvst.info/plugin-alliance-bundle-crack/: sedoparking.com | sedoparking.com/frmpark/ -",
        "https://rr2---sn-4g5ednsz.googlevideo.com/videoplayback?expire=1699319292&ei=nDlJZfb4G43E-gaYt5XoDg&ip=2001%3A1b60%3A2%3A240%3A3247%3A%3A",
        "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
        "http://softwarezpro.net/wp-content/themes/wellington/assets/js/svgxuse.min.js?ver=1.2.6",
        "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
        "Behavior Pattern Match Analysis",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "anti-spyware-software.net http://softwarezpro.net/wp |  |  http://softwarezpro.net/xmlrpc.php | https://softwarezpro.net https://softwarezpro.net/\t URL\thttps://softwarezpro.net/comments/feed/ https://softwarezpro.net/feed/\t https://softwarezpro.net/page/2/\t URL\thttps://softwarezpro.net/wp https://softwarezpro.net/xmlrpc.php",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 800c8a5f93b04d6c5dc491ab582cd75165918f5f - trojan",
        "#copyright #statements #malformed_copyright_statements",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://tvm77.fashiongup.in/tracking/track-open",
        "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "Trojan:Win32/Blihan: FileHash-SHA256  dada5208109416153937db5a6f44f03b8b9025347c235acdc70edfa24a2a882e",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/00734b135321562e7e0df7c2f8eb554435cc25c47f46747f79fc2116ac2cc6ef",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA1 fec703ee7c02ffe35c6b987bb9aac3a765e95dfb",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "Win32/Tasekjom.A : FileHash-SHA256 1230ac0c362b6049b9de011229707e05852dd11af75ca7071a1f089e6aca61f5",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "Yara Detections: Zeppelin_24 ,  Zeppelin_30 ,  Delphi",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger/",
        "http://softwarezpro.net/wp-content/themes/wellington/assets/js/navigation.min.js?ver=20220224 | crackedvst.info",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Rallypoint.com https://hybrid-analysis.com/sample/66287c2c36699037cb504201693e26b5f3282cebde1d1c78aecd6f97f04fb694",
        "Yara Detections: DotNET_Reactor",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "Ransom:Win32/Haperlock.A: FileHash-SHA1 c881d1434164b35fb16107a25f84995b7fdef37f",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "Win32/JakyllHyde - RUNDLL32.EXE FileHash-SHA1 01021c698664f7567b787d7bce266124ec0a226fb2e586125d109beb0ad0ba17",
        "http://medlineplus.gov.https.sci-hub.st",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "user-apple.info",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "apple.com.        (malicious version/header)",
        "Ransom:Win32/Tescrypt: FileHash-SHA256 916e13eb1e4313b2a04a2ae21b4955b8228183b26709a64284098ca759a8f437",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "Backdoor:Win32/Tofsee:  FileHash-SHA256 5b616ad2410bef0bc894c4bff013afe2d7f44dcdeb79420bab14c766cc460aa7",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
        "d1.cnbd.net  localhost.cnbd.net  mail.cnbd.net",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://uszoom.com/",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "ET TROJAN W32/Witch.3FA0!tr CnC Actiivty M2 - Source IP: 192.168.2.3 - Destination IP: 116.211.100.21",
        "IDS Detections : W32/Bayrob Attempted Checkin 2 CryptoWall Check-in AlphaCrypt CnC Beacon 4 Trojan-Ransom.Win32.Blocker.avsx",
        "Trojan:Win32/JakyllHyde: FileHash-SHA256 440165588e14516e1ef13b6240aad27a0e8c49744c8383590425b3cc9d7f23f1 - trojan",
        "Trojan:Win32/JakyllHyde: FileHash-SHA256 7512f88162744b57efd14cc5fb98bc7cf5588fa25c218a1e92fe8048932450a8 -trojan",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "Ranks high in search results because device is typically compromised with Convection engine and Keyword Tool",
        "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
        "ELF:Hajime-Q\\ [Trj] : FileHash-SHA256 aa310469926150f9d6f980dd6ba200d1c9c7dec7c4b66c7de4cff6a30c038560",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "http://borpatoken.com/ borpatoken.com",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "https://www.apple.com/sitemap/",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "Poemhunter.com: https://hybrid-analysis.com/sample/86479bf7c9a675913b93a0d399f5cbe0c0e8003239e93ae5e00f97cdbc5ec5ba",
        "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "PWS:Win32/Ymacco.AA50: FileHash-MD5 5739cd62eb88e2a7e514784fe7cf5ca4",
        "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
        "Trojan:Win32/Glupteba: FileHash-SHA256  5e7fdbc4c66fbefd6aa95047a56c709765f18b3a3a65d5942acb4e4349b09039",
        "www.jamesbgriffinlaw.com                     (malicious host)",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA256 105834163b1a0c89e12917a3145e14be6030a611e07f7f62fa7c57de838d6251",
        "Antivirus Detections: Win.Malware.Jaik-9940406-0",
        "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "System process connects to network (likely due to code injection or exploit)",
        "Ransom:Win32/Haperlock.A: FileHash-MD5 46480bf46cde2b3e79852661cc5c36fc",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "Trojan:Win32/JakyllHyde: FileHash-SHA256 37a641988cfb33066c12b68b23bec0623e3d0715d21d6e3b7304bdd7238c8790 - trojan",
        "Trojan:Win32/JakyllHyde: FileHash-SHA256 47d9e427da3dfe5253d0047c40fb773db59dbccb0ff650e86ce7490b2c520c2d - trojan",
        "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
        "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA256 4e692806955f9ee3f4c7a5d9a1ac7729eb53b855b39e6f9f943f89ccba30bd49",
        "Trojan:Win32/Zbot.SIBB3!MTB: FileHash-SHA256 bc1739628aadbcc99bcb93caab4a7a73534694c817d57cc0ed735bf4bd0f6e45",
        "https://sinister.ly/Thread-Apple-empty-box?page=13",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
        "Data Analytics",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
        "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
        "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://otx.alienvault.com/indicator/ip/162.222.213.199",
        "https://www.hallrender.com/attorney/brian-sabey/",
        "Alerts: persistence_autorun_tasks spawns_dev_util cape_detected_threat injection_process_hollowing",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "http://bpdb.portal.gov.bd:3128/sites/default/files/files/bpdb.portal.gov.bd/npfblock/2021-34bc869d2906198362a4346373ce5b94.jpg",
        "http://islamicsoftwares.com/downloads/iphone/audioCont/2/107.tar.gz http://islamicsoftwares.com/downloads/iphone/audioCont/7/110.tar.gz",
        "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
        "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
        "iobit: https://cracxfree.com/iobit-malware-fighter-pro-2/ | http://activationskey.net/wp-content/uploads/2021/02/download-2-7.jpg",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "https://matrix.pornhub.dev",
        "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
        "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.journaldev.com/41403/regex",
        "https://tulach.cc/ [malware engineering | phishing]",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "Alerts: infostealer_cookies infostealer_keylog recon_fingerprint suspicious_command_tools",
        "Trojan:Win32/Emotet.PC!MTB: FileHash-SHA256 02b9cac1880e348302125664c4955fd163a219b1eb8b50de0ad350e0c147a0b0",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "00000000000.cloudfront.net",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA1 7a52b57df5b3c67f810a71dc39ff93688b141534",
        "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
        "http://activationskey.net/passfab-for-rar-full-cracked-2022/ activationskey.net: https://activationskey.net/passware-kit-forensic-2021-1-3-crack/ activationskey.net: |  crackedvst.info:  crackedvst.info:",
        "enterprise.cellebrite.com [ digitalclues.com]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
        "animalpornotube.com | http://animalpornotube.com/files/gifamateurpay.gi | https://crackedvst.info/tag/k7-total-security-trial-resetter/",
        "artificial-legal-intelligence.com",
        "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
        "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "http://tuijian.adhei.com/douyu/v1/encrypt/gamebox_m.css",
        "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
        "Alerts: PlugX cape_extracted_content",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "https://www.hallrender.com/wp-content/themes/Hall-Render/assets/icons/apple-touch-icon.png",
        "Trojan:Win32/Salgorea: FileHash-SHA256  e82334440ceddd927f35831fda83594f3657ca56187f7f7ddd7d60cba1be793",
        "smartphonesonline.co.uk  https://smartphonesonline.co.uk/  https://www.smartphonesonline.co.uk/ [192.187.111.222. US - Request HTTP -Target IP]",
        "safebae.org",
        "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
        "https://www.google.com/search?q=tsara+brashears&prmd=vni&source=lnms&tbm=vid&sa=X&ved=2ahUKEwimqvSyxKrpAhUHTt8KHReZC7wQ_AUoAXoECAsQAQ&biw=375&bih=544&dpr=3/Malicious-Google-Search-Results-False",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
        "Worm:Win32/Mofksys: FileHash-SHA256 ef1a66214e210bc9ae0aef471b0a09f6083078343a0338fcaf1f2b04ebddbd9a",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://250awork.a-poster.info/ a-poster.info: http://252fwork.a-poster.info a-poster.info:  http://252fwork.a-poster.info/",
        "http://www.Apple.com/quicktime/download",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA256 71fa9257f88c15b438616662dc468327199edb570286c7259d333953006b8eec",
        "Ransom:Win32/LockScreen.BN",
        "Trojan:Win32/JakyllHyde: FileHash-SHA1 be97e5638139ee689312e23022d2e55e58d123c6 - trojan",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "www.tripphouse.com",
        "https://otx.alienvault.com/indicator/ip/185.230.63.186",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "mobileaccess.intel.com",
        "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://ssp.1rtb.com/imp?ua=Mozilla/5.0+(Linux;+Android+7.1.2;+SM-T555+Build/NMF26X;+wv)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Version/",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236",
        "Alerts: procmem_yara injection_inter_process creates_largekey network_bind persistence_autorun antivm_generic_disk",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
        "ALF:Trojan:Win32/Cassini_f28c33a2:\tFileHash-SHA256 6fc35cb8e18f0d9d72bc1a7037ae88f8036362799f930a1a30e290d31be3b216",
        "newrelic.se",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "\u2193\u2192Found in: https://house.mo.gov/\u2193",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://init-p01st.push.apple.com/bag        (remote hacking)",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "Trojan:Win32/Zombie.A: FileHash-SHA256 0b87667251b79cb800ddd88bdabecea8e13248c426d4a14ae0aae0ef5783f943",
        "https://activationskey.net/passfab-iphone-cracked-free-keys-2022 https://crackedvst.info/ui crackedvst.info: http://www.crackidea.net/",
        "45.159.189.105                                                (Command and Control)",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group",
            "Brian Sabey | Tulach | Sabey Data Centers",
            "Brian Sabey| The Brothers Sabey",
            "Lazarus Group  Brian Sabey",
            "[Unnamed group]",
            "Lazarus Group"
          ],
          "malware_families": [
            "Gen:variant.zusy",
            "Virtool:win32/injector",
            "Maltiverse",
            "Sodin ransomware",
            "204.79.197.200",
            "Trojan:win32/glupteba",
            "Pdf.phishing.ttraffrobotinstall-7605656-0",
            "Win.virus.teslacrypt3-2/custom",
            "Trojan:win32/vflooder.a",
            "Pegasus for ios - s0289",
            "Cobalt strike",
            "Maze",
            "Pws:win32/qqpass.ci",
            "Elf:hajime-q\\ [trj]",
            "Pws:msil/steam",
            "Generic.31fcc75f",
            "Ml.generic",
            "Asyncrat",
            "Noname057",
            "Win32/tofsee.ax",
            "Proxy",
            "Trojan:win32/trickler",
            "Win.keylogger.susppack-9876601-0",
            "Amadey",
            "Dark",
            "Gopher",
            "Tel:trojan:win32/trojandownloader",
            "Trojan:win32/muldrop",
            "Trojanspy",
            "Relic",
            "Wininicrypt",
            "Redline stealer",
            "Ransomexx",
            "Hacktool",
            "Ramnit",
            "Anonymizer",
            "Ransom:win32/lockscreen.bn",
            "Malware",
            "Backdoor.win32.shiz.ufj",
            "Agent tesla",
            "Chaos",
            "Ransom:win32/haperlock.a",
            "Beach research",
            "Skynet",
            "Worm:win32/fasong",
            "Zerobot",
            "Trojan.ole2.vbs",
            "Win32/socstealer!rfn",
            "Trojan:win32/cryptinject",
            "Qbot",
            "Emotet",
            "Generic.asmalws          malicious_confidence_70% 1\til:trojan.msilzilla 1\tfilerepmalware 1\transom.sabsik 1\tbehaveslike.dropper 1\tmicrosoft phishing 1\tbackdoor.mokes 1\tphishing bank of america corporat",
            "Tsara brashears",
            "Flubot",
            "Win.trojan.midia-4",
            "Azorult",
            "Quasar rat",
            "Pegasus",
            "Bandit stealer",
            "Pws:win32/ymacco.aa50",
            "Remcos rat",
            "Ransomware",
            "Sakula rat",
            "Artemis",
            "Win32:crypterx-gen\\ [trj]",
            "Trojan:win32/zombie.a",
            "Trojan.html.agent",
            "Alf:program:opencandy:remnant",
            "Et",
            "Formbook",
            "Tulach",
            "Arid.viper_cnc",
            "#lowfi:hstr:trojanspy:win32/bancos",
            "Trojan:linux/xorddos",
            "Ransom:win32/tescrypt",
            "Tel:delphi/obfuscator",
            "Trojan:win32/zbot.sibb3!mtb",
            "Win.trojan.occamy",
            "Adware.dropware",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "Securiteinfo.com.trojan.generickd.32885218.16582.30886.dll",
            "Tel:trojan:win32/emotet",
            "Worm:win32/mofksys",
            "Trojanspy:win32/nivdort.cw",
            "Undefined 1\tms 1\txyz 1\tgl 1\tnet tld aggregation com ms xyz gl net 20% 20% 20% 20% 20% tld\tcount com\t1 undefined\tnan ms\t1 xyz\t1 gl\t1 net\t1   combined blacklist timeline hybrid-analysis maltiverse resea",
            "Trojan:win32/pariham",
            "Dropper.binder",
            "Djvu",
            "Backdoor:win32/mydoom",
            "Slfper:installcore",
            "Slf:trojan:win32/grandoreiro.a",
            "Malicious.22a4c0",
            "Win.trojan.agent-336074",
            "Win.trojan.sdum-9807706-0",
            "Verified",
            "Tofsee",
            "Worm:win32/netsky",
            "Trojan:win32/blihan",
            "Trojan.generic",
            "W32.aidetectmalware",
            "W32/witch.3fa0!tr",
            "Njrat",
            "Backdoor.mokes",
            "Searchmeup",
            "Trojan:win32/qqpass",
            "Win32/tasekjom.a",
            "Evilnum",
            "Phishing hsbc",
            "Backdoor:win32/tofsee",
            "Trojan:win32/salgorea",
            "Email-worm.win32.brontok.n",
            "Nokoyawa ransomware",
            "Malware.generic",
            "Mitre attack",
            "Keylogger",
            "Bayrob",
            "Eternalblue",
            "Mirai",
            "Sdbot.caoc",
            "Cobalt strike - s0154",
            "Alf:trojan:win32/cassini_f28c33a2",
            "Ascii exploit",
            "Wannacry",
            "Generic.malware",
            "Colbalt strike",
            "Pegasus for android - mob-s0032",
            "Pws:win32/qqpass.b!mtb",
            "Win.packer.pkr_ce1a-9980177-0",
            "Win.malware.shellstartup-9892532-0",
            "Trojan.vtflooder/vflooder",
            "Other:malware-gen\\ [trj]",
            "Network rat",
            "Webtoolbar",
            "Rasmontr.dll",
            "Gen:variant.bulz",
            "#lowfi:siga:trojanspy:msil/keylogger",
            "Laplasclipper",
            "Win32.meredrop checkin",
            "Adwaresig [adw] ml.generic",
            "Phish.ab",
            "Ursnif",
            "Win.malware.jaik-9940406-0",
            "#lowficreateremotethread",
            "Pws:win32/vb",
            "Radar ineractive",
            "Qvm20.1.8d80.malware",
            "Win.trojan.emotet-9951800-0",
            "Trojan:win32/jakyllhyde",
            "Lockbit",
            "Gen:variant.razy",
            "Keyloggers",
            "Trojan:win32/emotet.pc!mtb",
            "Backdoor:win32/botgor",
            "Parallax rat",
            "Trojanclicker:win32/ellell.a",
            "Xpire.info",
            "Win32/trojandropper",
            "Trojan:win32/comame",
            "Hiddentear",
            "Trojanspy:win32/nivdort.di",
            "Gamehack.dr",
            "Trojan.ransom.generickd",
            "#virtool:win32/obfuscator",
            "Trojan.barys/cobalt",
            "#hstr:hacktool:win32/mimikatz",
            "W32.hack.generic",
            "Backdoor:win32/fynloski.a",
            "Malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tunsafe.ai_score_98% 1\tmobigame 1\tbanker,evasive,retefe 1\tprogram.unwanted 1\tmalicious.high.ml 1\tkryptik.dawvk 1\tunsafe.ai_score_91% 1\tadwar",
            "Hallrender",
            "Qakbot"
          ],
          "industries": [
            "Civilian society",
            "Civil society",
            "Advocacy",
            "Technology",
            "Media",
            "Telecommunications",
            "Healthcare",
            "Civilian devices"
          ],
          "unique_indicators": 309182
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/hallrender.com",
    "whois": "http://whois.domaintools.com/hallrender.com",
    "domain": "hallrender.com",
    "hostname": "vcards.hallrender.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 50,
  "pulses": [
    {
      "id": "69d68fffbf012630d57033b6",
      "name": "Sabey SWIPPER - Pornhub\u00bbX.Com migration to Twitter | Sabey\u2019s Daddy Data Center ",
      "description": "",
      "modified": "2026-04-08T17:27:27.851000",
      "created": "2026-04-08T17:27:27.851000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69bea426487bffa5384c6f38",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "11 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf8e2663d5480917ddb699",
      "name": "Pegasus - https://house.mo.gov/ | Brian Sabey HallRender [i cloned OctoSeek] T8",
      "description": "",
      "modified": "2026-03-22T08:35:26.266000",
      "created": "2026-03-22T06:37:26.233000",
      "tags": [
        "united",
        "as393601 state",
        "a domains",
        "passive dns",
        "as397241",
        "certificate",
        "urls",
        "search",
        "showing",
        "entries",
        "algorithm",
        "full name",
        "data",
        "v3 serial",
        "number",
        "cus cndigicert",
        "global g2",
        "tls rsa",
        "sha256",
        "ca1 odigicert",
        "info",
        "record type",
        "ttl value",
        "all txt",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "resolutions",
        "historical ssl",
        "communicating",
        "problems",
        "parent domain",
        "njrat",
        "ransomware",
        "startpage",
        "historical",
        "malware",
        "execution",
        "threat roundup",
        "april",
        "september",
        "remcos rat",
        "august",
        "june",
        "qakbot",
        "push",
        "service",
        "privateloader",
        "amadey",
        "powershell",
        "qbot",
        "cobalt strike",
        "core",
        "hacktool",
        "november",
        "october",
        "roundup",
        "threat network",
        "cellbrite",
        "february",
        "emotet",
        "maze",
        "metro",
        "dark",
        "malicious",
        "team",
        "critical",
        "copy",
        "awful",
        "parallax rat",
        "banker",
        "keylogger",
        "dns replication",
        "date",
        "csc corporate",
        "domains",
        "code",
        "server",
        "registrar abuse",
        "registrar iana",
        "registry domain",
        "registrar url",
        "registrar",
        "contact phone",
        "apple ios",
        "quasar",
        "remcos",
        "ursnif",
        "chaos",
        "ransomexx",
        "azorult",
        "agent tesla",
        "evilnum",
        "asyncrat",
        "win32 exe",
        "wininit",
        "beta version",
        "cmstp",
        "taskscheduler",
        "ieudinit",
        "nat32",
        "certsentry",
        "type name",
        "wc3 rpg",
        "pegasus",
        "unknown",
        "domain",
        "servers",
        "germany unknown",
        "name servers",
        "status",
        "next",
        "as29066 host",
        "as133618",
        "cname",
        "as47846",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "encrypt",
        "china unknown",
        "as38365 beijing",
        "as134175 unit",
        "707713",
        "hong kong",
        "virgin islands",
        "as6461 zayo",
        "ransom",
        "exploit",
        "ipv4",
        "pulse submit",
        "url analysis",
        "trojan",
        "body",
        "click",
        "creation date",
        "emails",
        "expiration date",
        "domain privacy",
        "hostname",
        "dynamicloader",
        "state",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "show",
        "slcc2",
        "media center",
        "error",
        "delphi",
        "guard",
        "write",
        "win32",
        "target",
        "redir",
        "facebook",
        "dcom",
        "local",
        "delete",
        "utf8",
        "unicode text",
        "crlf line",
        "rgba",
        "yara detections",
        "default",
        "asnone",
        "get na",
        "dns lookup",
        "probe ms17010",
        "eternalblue",
        "playgame",
        "high",
        "related pulses",
        "yara rule",
        "anomalous file",
        "dynamic",
        "malware infection",
        "cnc",
        "procmem_yara",
        "antivm_generic_disk",
        "modify_proxy infostealer_cookies",
        "network_http",
        "anomalous_deletefile",
        "antidebug_guardpages",
        "powershell_request",
        "powershell_download",
        "as63949 linode",
        "mtb feb",
        "open ports",
        "backdoor",
        "gmt content",
        "trojandropper",
        "simda",
        "lockbit",
        "win.trojan",
        "midia-4",
        "floxif",
        "cryptowall",
        "brontok",
        "check in",
        "record value",
        "files",
        "location united",
        "america asn",
        "as16509",
        "download",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls http",
        "samples",
        "tsara brashears",
        "2nd corintnthians 4:8-9",
        "injection_inter_process",
        "injection_create_remote_thread",
        "persistence_autorun",
        "bypass_firewall",
        "disables_windowsupdate",
        "dynamic_function_loading",
        "http_request",
        "query",
        "delete c",
        "activity dns",
        "components",
        "file execution",
        "observed dns",
        "as4837 china",
        "nxdomain",
        "a nxdomain",
        "wannacry",
        "missouri",
        "safebae",
        "hallrender",
        "house.mo.gov",
        "typosquatting",
        "tactics",
        "google",
        "win64",
        "khtml",
        "gecko",
        "veryhigh",
        "aes256gcm",
        "dalles",
        "cookie",
        "urls https",
        "xpcegvo2adsnq",
        "mhkz",
        "mvi2",
        "keepaliveyes",
        "fexp24007246",
        "nsyt",
        "eva reimer",
        "daisy coleman",
        "brian sabey",
        "https://lawlink.com/documents/10935/blackbag-technologies-announ"
      ],
      "references": [
        "https://house.mo.gov/ \u2022 house.mo.gov \u2022 mo.gov",
        "dns.msftncsi.com",
        "NSO Group - Pegasus: enterprise.cellebrite.com \u2022 cellebrite.com \u2022 erp002.blackbagtech.com \u2022 140.108.21.184",
        "Target\u2193\u2192 Tsara Brashears:  https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "23.216.147.64",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Apple/ iOS unlocker password decryption]",
        "http://alohatube.xyz/search/tsara-brashears [Telecom \u2022 Brashears Telecom services modified (malicious)]",
        "alohatube.xyz [BotNetwork]",
        "facebooksunglassshop.com",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com - Lockbit Black 3.0, Observed AridViper CnC Domain, Win.Trojan.Midia-4",
        "oooooooooo.ga \u2022 rallypoint.com \u2022 pornhub.dev \u2022 chats.pornhub.dev \u2022 https://twitter.com/PORNO_SEXYBABES \u2022 https://matrix.pornhub.dev \u2022 https://git.pornhub.dev",
        "http://dobkinfamily.com/__media__/js/netsoltrademark.php?d=www.fap18pgals.eu/cum-on-ass-porn/",
        "government.westlaw.com \u2022 hero9780.duckdns.org \u2022 hallrender.com \u2022 miles-andmore.duckdns.org",
        "https://otx.alienvault.com/indicator/url/https://miles-andmore.duckdns.org/ihFKGyel4wizIPNVvHHQQIuHfl4hEb2F6gWEXupmNDuiMJgJtshSlLFmilf3zCT2EF/index.html",
        "remote.utorrent.com [remote router logins]",
        "Tracking: http://www.trackip.net/ip \u2022 gfx.ms \u2022 dssruletracker.mo.gov [network] \u2022 earlyconnections.mo.gov \u2022 www77.trackerspy.com \u2022 ww38.track.updatevideos.com",
        "http://tracking.studyportalsmail.com/about/privacy/?cdmtw=BAAAIAEAIGmGCaIK4E8-IsDv \u2022 tracking.studyportalsmail.com \u2022 plugtrack.online",
        "http://images.startappservice.com/image/fetch/f_auto \u2022 track.smtpsendemail.com \u2022 nr-data.net [apple] \u2022 lg.as35280.net \u2022 leaseway.damstracking.com",
        "http://tvm77.fashiongup.in/tracking/track-open",
        "https://www.house.mo.gov:80/messageboard/ \u2022 extranet16.mo.gov \u2022 login.mo.gov \u2022 witness.house.mo.gov \u2022 dps.mo.gov \u2022 dev-publicdefender.mo.gov",
        "https://www.hallrender.com/wp-content/uploads/2016/02/Denver-150x150.jpg",
        "http://hallrender.com/attorney/brian-sabey \u2022 https://hallrender.com/attorney/brian-sabey \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https://www.hallrender.com/attorney/brian-sabey/&",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-48x48.png \u2022 http://2fwww.hallrender.com/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png \u2022 https://vcards.hallrender.com/",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-300x300.png \u2022 http://mail2.hallrender.com/",
        "hallrender.com \u2022 government.westlaw.com \u2022 http://dev.hallrender.com/ \u2022 https://mercy.hallrender.com/ \u2022 autodiscover.hallrender.com",
        "http://web2.westlaw.com/find/default.wl?tf=-1&rs=WLW9.10&referencepositiontype=S&serialnum=1987042953&fn=_top&sv=Split&referenceposition=1555&pbc=D5845283&tc=-1&ordoc=1989026578&findtype=Y&db=708&vr=2.0&rp=/find/default.wl&mt=208",
        "https://otx.alienvault.com/indicator/ip/45.56.79.23 \u2022 batchcourtexpressservices.westlaw.com \u2022 courtexpress.westlaw.com",
        "safebae.org \u2022 rp.dudaran2.com \u2022 www.safebae.org \u2022 https://safebae.org/%20%5B \u2022 https://safebae.org/about/ \u2022 https://safebae.org/",
        "https://safebae.org/wp-content/plugins/addons-for-visual-composer/assets/js/slick.min.js?ver=2.9.2 \u2022 https://api.w.org/ \u2022 247.0.198.104.bc.googleusercontent.com",
        "https://safebae.org/wp-json/ \u2022 https://safebae.org/wp-content/plugins/embed-any-document/css/embed-public.min.css?ver=2.7.4",
        "Malware Hosting: http://81.5.88.13/dbreader.exe \u2022 http://utasoft.ru/catalog/view/javascript/jquery/ui/jquery-ui-1.8.16.custom.min.js",
        "Apple Malware: http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Apple unlocker, decryption via media]",
        "Malware Hosting: deviceinbox.com \u2022 http://www.hakoonportal.net/240714d/240714_t2.exe \u2022103.246.145.111 \u2022 Spyware: stream.ntpserver.store",
        "https://nl.toyota.be/tme [vehicle spyware, camera, data, speakers]",
        "http://link.mcsa.org/api/LinkHandler/getaction?redirectParam2=K09weU5vMDBKWW90Wk1hcHl4SmF4NGtHbnBGbjJaVElud2tpMlBaUGhseXZNM0JLaHRaUnJZOVh1bmMvSVhYWDZhb0UwY2hPaGVuSGNDRUFYeHNzWWFQL0dBNVlRVmlTSGpXa016bUQzWUZ6cVZRcktRTmRyZHJPYlBrY1NpSyt6ZzBrS0FjWk9EYSs4WmdOc2RBU09CR1RjWVNiTUZpYkhNV1lvNzkwbzhLMUxDUzQzS0FaVU5LYTZWSUZoS1Vt",
        "sexuallybroken.info \u2022 sinful-bordello.top-sex.us \u2022 crackedtool.com \u2022 kddi-cloud.com \u2022 http://tuksex.duckdns.org/bb/login.php",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "China",
        "Australia",
        "Hong Kong"
      ],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "AsyncRAT",
          "display_name": "AsyncRAT",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Chaos",
          "display_name": "Chaos",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "EVILNUM",
          "display_name": "EVILNUM",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Keylogger",
          "display_name": "Keylogger",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "Parallax RAT",
          "display_name": "Parallax RAT",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Remcos RAT",
          "display_name": "Remcos RAT",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-336074",
          "display_name": "Win.Trojan.Agent-336074",
          "target": null
        },
        {
          "id": "Arid.Viper_CnC",
          "display_name": "Arid.Viper_CnC",
          "target": null
        },
        {
          "id": "WininiCrypt",
          "display_name": "WininiCrypt",
          "target": null
        },
        {
          "id": "PWS:Win32/QQpass.CI",
          "display_name": "PWS:Win32/QQpass.CI",
          "target": "/malware/PWS:Win32/QQpass.CI"
        },
        {
          "id": "Win.Trojan.Midia-4",
          "display_name": "Win.Trojan.Midia-4",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Win32/SocStealer!rfn",
          "display_name": "Win32/SocStealer!rfn",
          "target": null
        },
        {
          "id": "Backdoor.Win32.Shiz.ufj",
          "display_name": "Backdoor.Win32.Shiz.ufj",
          "target": null
        },
        {
          "id": "Email-Worm.Win32.Brontok.n",
          "display_name": "Email-Worm.Win32.Brontok.n",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65c91f2b7c03b480379ae4d1",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2668,
        "FileHash-SHA1": 2469,
        "FileHash-SHA256": 8054,
        "URL": 6185,
        "domain": 2421,
        "hostname": 3042,
        "CVE": 5,
        "email": 15,
        "CIDR": 1,
        "IPv4": 18
      },
      "indicator_count": 24878,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "28 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bea426487bffa5384c6f38",
      "name": " Brian Sabey illegally deleting IoC\u2019s | SWIPPER - Pornhub\u00bbX.Com migration to Twitter Sabey Erasing",
      "description": "",
      "modified": "2026-03-21T13:59:02.016000",
      "created": "2026-03-21T13:59:02.016000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "29 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6872f4c510c590b7cdc5ff6a",
      "name": "Crowdsourced Collection of PayPal Mafia Monster - Foundry\u2019s Palantair",
      "description": "Americans are investing in what Edward Snowden foretold of\u2026 your future from beginning to end will  predict how you will be treated. Preemptively policing people even if you have to make up a past.. |\n\nThe New York Times\nMay 30, 2025 \u2014 The Trump administration has expanded Palantir's work with the government, spreading the company's technology \u2014 which could easily merge data on ...\nFormer Palantir workers condemn company's work with ...\n\nNPR\nMay 5, 2025 \u2014 Thirteen former employees of influential data-mining firm Palantir are condemning the company's work with the Trump administration.\nWyden AOC Palantir Letter 061725\n\nSenate Finance (.gov)\nJun 17, 2025 \u2014 The Trump Administration has spent taxpayer dollars on Palantir software at numerous other government agencies and paid it billions of dollars ...\n#foundry #rip #palantir #jeffreyreimerdpt #lawenforcement #twitter #tsarabrashearsblessed #apple #privacynow #fightforprivacy #sabey #hallrender",
      "modified": "2025-08-11T23:02:24.583000",
      "created": "2025-07-12T23:50:29.847000",
      "tags": [
        "url https",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "entries",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "enter source",
        "urior exirag",
        "diri type",
        "data upload",
        "extraction",
        "failed",
        "included iocs",
        "review iocs",
        "find sugge",
        "extr extract",
        "in data",
        "extract",
        "type",
        "u extractio",
        "extra",
        "review ic",
        "ipv4",
        "pulses hostname",
        "accountunlock",
        "united",
        "ireland",
        "canada",
        "brazil",
        "sweden",
        "australia",
        "search",
        "scan",
        "iocs",
        "learn more",
        "filehashsha1",
        "filehashmd5",
        "types of",
        "extra data",
        "included review",
        "china",
        "colombia",
        "filepath https",
        "enter sc",
        "extr data",
        "include review",
        "exclude sugges",
        "filehashsha256",
        "hostname",
        "dicators japan",
        "url tor",
        "extrac data",
        "ic excluded",
        "suggeste",
        "stop",
        "type no",
        "no entrie",
        "included",
        "review locc",
        "excluded data",
        "sc data",
        "extri data",
        "includec review",
        "exclude data",
        "suggested",
        "se extra",
        "suggest",
        "manaiv add",
        "indicator",
        "review lace",
        "extri",
        "find s",
        "typ no",
        "no entdi",
        "ous u",
        "dron aew",
        "avtrat",
        "extre data",
        "manually",
        "add indicator",
        "pulses url",
        "url url",
        "typ host",
        "host url",
        "include",
        "z6911541",
        "extraction fail",
        "enter souf",
        "s type",
        "ur extraction",
        "extraction data",
        "jul all",
        "pulse data",
        "report external",
        "review",
        "extre please",
        "se extraction",
        "report spam",
        "all t8",
        "firmip",
        "bofa",
        "wikileaks",
        "tmobile",
        "dish",
        "capture",
        "cookie",
        "enter s",
        "please sub",
        "include outroov",
        "excludel sugges",
        "extra please",
        "high priority",
        "alerts ids",
        "priority alerts",
        "cnc beacon",
        "winver",
        "digitalmistica",
        "november",
        "pulse",
        "palantir",
        "foundry twitter",
        "arkei stealer",
        "config",
        "install",
        "downloader",
        "cidr",
        "domain",
        "indicators hong",
        "kong",
        "ukraine",
        "status no",
        "object",
        "unruy",
        "http",
        "remote",
        "keylogger",
        "foundry created",
        "days ago",
        "white keylogger",
        "apple",
        "foundry tech",
        "mafia",
        "t1045",
        "packing",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1457",
        "showing",
        "types",
        "indicators show",
        "dicator role",
        "tsara brashears",
        "tsara",
        "porn",
        "porn videos",
        "pornhub https",
        "searchtsar",
        "watch tsara",
        "most relevant",
        "open threat",
        "green",
        "love",
        "daily",
        "videos",
        "free porn",
        "hybrid analysis",
        "falcon sandbox",
        "top tsara",
        "brashears porn",
        "stream",
        "spice",
        "download",
        "hybrid",
        "njrat",
        "threat network",
        "https",
        "created",
        "years ago",
        "modified",
        "months ago",
        "tinynote",
        "douglas county",
        "co sheriff",
        "office",
        "pegasus attacks",
        "sa victim",
        "octoseek public",
        "white",
        "excludedocs",
        "sugges",
        "stop data",
        "tsara lynn",
        "brashears les",
        "lynn brashears",
        "translate",
        "pornhub page",
        "emotet",
        "se review",
        "typ url",
        "dom hos",
        "hostname data",
        "harmful",
        "octoseekpulse",
        "attacks sa",
        "bandit stealer",
        "flubot",
        "agent tesla",
        "qbot",
        "qakbot",
        "ursnif",
        "azorult",
        "djvu",
        "hacktool",
        "maze",
        "dark",
        "linux",
        "android10",
        "khtml",
        "costcpc",
        "userosandroid",
        "bannerid2738231",
        "india",
        "enter so",
        "please subr",
        "suggest data",
        "netherlands",
        "russia",
        "america malware",
        "families",
        "sc type",
        "please",
        "show",
        "url data",
        "fanec",
        "include failed",
        "review exclude",
        "extre",
        "includea",
        "exclude toosrou",
        "sugges data",
        "typ data",
        "information",
        "cobalt strike",
        "ransomexx",
        "quackbot",
        "comspec",
        "span",
        "idn1",
        "sendimage0",
        "refts0",
        "include data",
        "uny inuuue",
        "fileh fileh",
        "exclude suggest",
        "uniy",
        "type fileh",
        "extr please",
        "ineluderc\u0660",
        "review data",
        "excludedlocs"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1065",
          "name": "Uncommonly Used Port",
          "display_name": "T1065 - Uncommonly Used Port"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 58,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12679,
        "domain": 1134,
        "hostname": 3543,
        "FileHash-MD5": 251,
        "email": 7,
        "FileHash-SHA256": 1927,
        "FileHash-SHA1": 232,
        "CVE": 1,
        "CIDR": 1,
        "URI": 1
      },
      "indicator_count": 19776,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "686ab98ff0cb9baa4e2b2000",
      "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied  OctoseekPulse)  Attacks SA victims?",
      "description": "",
      "modified": "2025-08-05T21:02:46.419000",
      "created": "2025-07-06T17:59:43.440000",
      "tags": [
        "runtime process",
        "localappdata",
        "size",
        "sha256",
        "sha1",
        "temp",
        "prefetch8",
        "prefetch1",
        "unicode text",
        "type data",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "mitre",
        "writes a pe file header to disc",
        "show process",
        "date",
        "document file",
        "v2 document",
        "ascii text",
        "malicious",
        "local",
        "path",
        "found",
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "october",
        "resolutions",
        "apple ios",
        "referrer",
        "communicating",
        "execution",
        "june",
        "august",
        "emotet",
        "qakbot",
        "agent tesla",
        "azorult",
        "core",
        "maze",
        "metro",
        "dark",
        "team",
        "critical",
        "copy",
        "awful",
        "ursnif",
        "hacktool",
        "info",
        "qbot",
        "april",
        "njrat",
        "nokoyawa",
        "djvu",
        "flubot",
        "ransomware",
        "bandit stealer",
        "hallrender",
        "spyware",
        "safebae",
        "tsara brashears",
        "westlaw",
        "river.rocks",
        "brian sabey",
        "targeting",
        "dnspionage",
        "united",
        "unknown",
        "search",
        "aaaa",
        "showing",
        "domain",
        "creation date",
        "record value",
        "dnssec",
        "body",
        "passive dns",
        "encrypt",
        "as14061",
        "germany unknown",
        "as397240",
        "gmt server",
        "443 ma2592000",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "main",
        "installing",
        "as16276",
        "france unknown",
        "name servers",
        "as8075",
        "servers",
        "next",
        "as63949 linode",
        "as206834 team",
        "canada unknown",
        "status",
        "as61969 team",
        "msie",
        "chrome",
        "ransom",
        "gone",
        "title",
        "head body",
        "malware"
      ],
      "references": [
        "\u2193\u2192Found in: https://house.mo.gov/\u2193",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "demo.auth.civicalg.com.sni.cloudflaressl.com",
        "happyrabbit.kr [Apple iOS threat]",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "http://nudeteenporn.site"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Nokoyawa Ransomware",
          "display_name": "Nokoyawa Ransomware",
          "target": null
        },
        {
          "id": "Bandit Stealer",
          "display_name": "Bandit Stealer",
          "target": null
        },
        {
          "id": "FluBot",
          "display_name": "FluBot",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Djvu",
          "display_name": "Djvu",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1065",
          "name": "Uncommonly Used Port",
          "display_name": "T1065 - Uncommonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65c96df8fe0657d56a206a49",
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 251,
        "FileHash-SHA1": 211,
        "FileHash-SHA256": 3226,
        "domain": 1867,
        "URL": 10030,
        "hostname": 2919,
        "CVE": 7,
        "email": 6
      },
      "indicator_count": 18517,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "256 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68888ed9c3a537ac4491eba7",
      "name": "Jeffrey Reimer PT DPT | Brian Sabey, SWIPPER - Pornhub\u00bbX.Com migration [scoreblue]",
      "description": "",
      "modified": "2025-07-29T09:05:29.205000",
      "created": "2025-07-29T09:05:29.205000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb08c239be3721ab6c9050",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 443,
        "URL": 1878,
        "domain": 312,
        "hostname": 518,
        "email": 5,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3395,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "264 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66804428b487338dc16f70a7",
      "name": "Brian Sabey Orbiting Tsara Brashears and associates | Espionage | Said client: Jeffrey Reimer",
      "description": "Brian Sabey & large team continue excessive orbiting target & family members in multiple states. \nUnwarranted, dangerous and illegal. \nLarge attacks have wreaked havoc on medical establishments, targets medical profile, once profitable business, legal manipulation, financial well being. forced poverty, swatting, imfostealer, insurance fraud, intellectual property use, Audi le spying, in person stalking, confrontations, great bodily harm, loss of peace, safety. basic human rights and privacy, phone call redirection, malvertising. In the name of assaulter Jeffrey Scott Reimer",
      "modified": "2024-11-05T10:00:12.606000",
      "created": "2024-06-29T17:28:08.283000",
      "tags": [
        "unknown",
        "united",
        "virgin islands",
        "as51852",
        "as33387",
        "as19905",
        "as44273 host",
        "cname",
        "nxdomain",
        "passive dns",
        "url http",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "entries",
        "urls",
        "files ip",
        "address domain",
        "ip related",
        "pulses otx",
        "pulses",
        "related tags",
        "indicator facts",
        "dga domain",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "pulse pulses",
        "ip address",
        "related nids",
        "log id",
        "gmtn",
        "go daddy",
        "authority",
        "tls web",
        "arizona",
        "scottsdale",
        "ca issuers",
        "b59bn timestamp",
        "ff2c217402202b",
        "code",
        "false",
        "url https",
        "domain",
        "trojan",
        "hostname",
        "files",
        "body",
        "date",
        "path max",
        "age86400 set",
        "cookie",
        "script urls",
        "type",
        "mtb may",
        "script script",
        "trojanspy",
        "striven",
        "miles2",
        "rexxfield",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "date sat",
        "gmt server",
        "sakula malware",
        "historical ssl",
        "realteck audio",
        "lemon duck",
        "iocs",
        "tsara brashears",
        "loki password",
        "stealer",
        "windows",
        "auction",
        "metro",
        "core",
        "colibri loader",
        "hacktool",
        "status",
        "for privacy",
        "creation date",
        "record value",
        "name servers",
        "showing",
        "next",
        "mtb mar",
        "ipv4",
        "ransom",
        "west domains",
        "redacted for",
        "gmt location",
        "gmt max",
        "cowboy",
        "encrypt",
        "as60558 phoenix",
        "susp",
        "win32",
        "methodpost",
        "canada unknown",
        "as43350 nforce",
        "united kingdom",
        "as47846",
        "germany unknown",
        "briansabey",
        "body doubles",
        "orbiters",
        "malvertising",
        "cane",
        "get na",
        "show",
        "as16509",
        "delete c",
        "sinkhole cookie",
        "value snkz",
        "cape",
        "possible",
        "copy",
        "nivdort",
        "write",
        "bayrob",
        "malware",
        "exploit",
        "confirm https",
        "impact",
        "misc http",
        "cvss v2",
        "authentication",
        "n cvss",
        "v3 severity",
        "high attack",
        "emails",
        "cnc",
        "alphacrypt cnc",
        "beacon",
        "as15169 google",
        "limited",
        "as8560",
        "elite",
        "AS33387 nocix llc",
        "pegasus",
        "mercenary",
        "cellerebrand",
        "cellebrite",
        "apple",
        "dark",
        "apple ios",
        "ios",
        "apple iphone",
        "apple itunes",
        "itunes",
        "pegasystem",
        "data brokers",
        "hackers",
        "javascript",
        "please",
        "intel",
        "filehash",
        "av detections",
        "xorddos"
      ],
      "references": [
        "http://www.northpoleroute.com/78985064&type=0&resid=5312625",
        "espysite.azurewebsites.net - https://otx.alienvault.com/indicator/hostname/espysite.azurewebsites.net",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256\t251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "TrojanSpy:Win32/Nivdort.CW: FileHash-SHA256 aa289c89f2cdbfe896f4c77c611d94aa95858797014b57e24d5fe2bb0997d7b0",
        "Ransom:Win32/Haperlock.A: FileHash-MD5 46480bf46cde2b3e79852661cc5c36fc",
        "Ransom:Win32/Haperlock.A: FileHash-SHA1 c881d1434164b35fb16107a25f84995b7fdef37f",
        "Ransom:Win32/Haperlock.A; FileHash-SHA256 8264c73f129d4895573c2375ea4e4636b9d5df66852ce72ccc20d31a96ae7df1",
        "IDS Detections: W32/Bayrob Attempted Checkin 2 Terse HTTP 1.0 Request Possible Nivdort W32/Bayrob Attempted Checkin",
        "IDS Detections: Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "Alerts: cape_detected_threat cape_extracted_content",
        "https://otx.alienvault.com/indicator/file/251150379b9a0ff230899777f0952d3833a88c1a2d6a0101ea13bdd91a9550fe",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "\"Windows SMB Information Disclosure Vulnerability.\" - https://otx.alienvault.com/indicator/cve/CVE-2017-0147",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA256 4e692806955f9ee3f4c7a5d9a1ac7729eb53b855b39e6f9f943f89ccba30bd49",
        "Backdoor:Win32/Fynloski.A: FileHash-SHA 453355033bb7977831ca87cc90156b594f13b2ee",
        "Backdoor:Win32/Fynloski.A: FileHash-MD5 c3113684e8f8aa6d1b1b67d59141e845",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA256 7456108771e6a8bac658276c1cb9e18c8c348fdd9cd3538419751c3b5ef3ac02",
        "TrojanClicker:Win32/Ellell.A: FileHash-SHA1 7a52b57df5b3c67f810a71dc39ff93688b141534",
        "TrojanClicker:Win32/Ellell.A: 4d3e7d486ec5918d91e54e51c4d07dc6",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA256 105834163b1a0c89e12917a3145e14be6030a611e07f7f62fa7c57de838d6251",
        "PWS:Win32/Ymacco.AA50: FileHash-SHA1 57486d33246bce6dfedb0836cd97c9acd4a4a39a",
        "PWS:Win32/Ymacco.AA50: FileHash-MD5 5739cd62eb88e2a7e514784fe7cf5ca4",
        "https://otx.alienvault.com/indicator/ip/162.222.213.199",
        "TrojanDownloader:Win32/PurityScan.MI!MTB: FileHash-SHA1 58ba8715a88d883537ba8d0e20eea2a4d9269cad",
        "Ransom:Win32/Tescrypt: FileHash-SHA256 916e13eb1e4313b2a04a2ae21b4955b8228183b26709a64284098ca759a8f437",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA256 71fa9257f88c15b438616662dc468327199edb570286c7259d333953006b8eec",
        "PWS:Win32/QQpass.B!MTB: FileHash-SHA1 fec703ee7c02ffe35c6b987bb9aac3a765e95dfb",
        "PWS:Win32/QQpass.B!MTB: FileHash-MD5 f7c36b4e5b4b09dc369163377aade2d7",
        "Trojan:Win32/Zombie.A: FileHash-SHA256 0b87667251b79cb800ddd88bdabecea8e13248c426d4a14ae0aae0ef5783f943",
        "Trojan:Win32/Zombie.A: FileHash-SHA1 de974c697f0401d681e1bb3c8694a663e9e43d8f",
        "Trojan:Win32/Zombie.A: FileHash-MD5 34e85820b41c14e07dd564f22997e893",
        "Win.Virus.TeslaCrypt3-2: 78af1fd5be62ab829e49f9a1b5fbb8a9b30f8d0804cba5805c8f350b841d522e",
        "IDS Detections : W32/Bayrob Attempted Checkin 2 CryptoWall Check-in AlphaCrypt CnC Beacon 4 Trojan-Ransom.Win32.Blocker.avsx",
        "IDS Detections : AlphaCrypt CnC Beacon 3 MalDoc Request for Payload Aug 17 2016 Koobface W32/Bayrob Attempted Checkin",
        "IDS Detections : Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "https://otx.alienvault.com/indicator/ip/185.230.63.186",
        "CnC IP's: 192.187.111.221  63.141.242.43  63.141.242.44  63.141.242.46 81.17.18.195  81.17.18.197 81.17.29.146  81.17.29.148",
        "http://islamicsoftwares.com/downloads/iphone/audioCont/2/107.tar.gz http://islamicsoftwares.com/downloads/iphone/audioCont/7/110.tar.gz",
        "smartphonesonline.co.uk  https://smartphonesonline.co.uk/  https://www.smartphonesonline.co.uk/ [192.187.111.222. US - Request HTTP -Target IP]",
        "Mercenary Attackers / Cellebrite branded as: http://teacellertea.com/Pegasus/ NSO",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://otx.alienvault.com/indicator/file/0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://otx.alienvault.com/indicator/ip/63.141.242.45",
        "Yara Detections: is__elf ,  xorddos ,  LinuxXorDDoS_VariantTwo",
        "Antivirus Detections: ELF:Xorddos-AE\\ [Trj] ,  Unix.Trojan.Xorddos-1 ,",
        "Trojan:Linux/Xorddos: FileHash-MD5 3b4ce1333614cd21c109054630e959b9",
        "Trojan:Linux/Xorddos:  FileHash-SHA1 a5780498e6fce5933a7e7bf59a6fa5742e97f559",
        "Trojan:Linux/Xorddos: FileHash-SHA256 0002f7cbc10cfea832f117d66dea2d33e6ca1d5cea57d9af0784255e0112d658",
        "https://hallrender.com/attorney/brian-sabey"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort.CW",
          "display_name": "TrojanSpy:Win32/Nivdort.CW",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
        },
        {
          "id": "Ransom:Win32/Haperlock.A",
          "display_name": "Ransom:Win32/Haperlock.A",
          "target": "/malware/Ransom:Win32/Haperlock.A"
        },
        {
          "id": "Backdoor:Win32/Fynloski.A",
          "display_name": "Backdoor:Win32/Fynloski.A",
          "target": "/malware/Backdoor:Win32/Fynloski.A"
        },
        {
          "id": "TrojanClicker:Win32/Ellell.A",
          "display_name": "TrojanClicker:Win32/Ellell.A",
          "target": "/malware/TrojanClicker:Win32/Ellell.A"
        },
        {
          "id": "Bayrob",
          "display_name": "Bayrob",
          "target": null
        },
        {
          "id": "Win.Virus.TeslaCrypt3-2/Custom",
          "display_name": "Win.Virus.TeslaCrypt3-2/Custom",
          "target": null
        },
        {
          "id": "PWS:Win32/Ymacco.AA50",
          "display_name": "PWS:Win32/Ymacco.AA50",
          "target": "/malware/PWS:Win32/Ymacco.AA50"
        },
        {
          "id": "Ransom:Win32/Tescrypt",
          "display_name": "Ransom:Win32/Tescrypt",
          "target": "/malware/Ransom:Win32/Tescrypt"
        },
        {
          "id": "PWS:Win32/QQpass.B!MTB",
          "display_name": "PWS:Win32/QQpass.B!MTB",
          "target": "/malware/PWS:Win32/QQpass.B!MTB"
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Pegasus for iOS - S0289",
          "display_name": "Pegasus for iOS - S0289",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Trojan:Linux/Xorddos",
          "display_name": "Trojan:Linux/Xorddos",
          "target": "/malware/Trojan:Linux/Xorddos"
        },
        {
          "id": "Sakula RAT",
          "display_name": "Sakula RAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 106,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3885,
        "hostname": 1651,
        "URL": 5981,
        "FileHash-MD5": 486,
        "FileHash-SHA256": 3859,
        "SSLCertFingerprint": 2,
        "FileHash-SHA1": 487,
        "CVE": 7,
        "email": 8
      },
      "indicator_count": 16366,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "530 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f351ce26a103377d8eb5fa",
      "name": "Sex Tokens | Injection \u00bb Porn dumping - Cyber Folks .PL | Spectrum",
      "description": "Porn dumping into targeted devices after great effort. \nHall Render has always been a Malware Hosting website.\nDrive by compromise,    \nPorn Storm compilation.\n\nhttps://api.dotz.com.br/accounts/api/default/externallogin/login",
      "modified": "2024-10-24T22:01:13.406000",
      "created": "2024-09-24T23:57:02.111000",
      "tags": [
        "url https",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "porn type",
        "showing",
        "entries",
        "tsara type",
        "pulses url",
        "adware backdoor",
        "email document",
        "exploit domain",
        "owner exploit",
        "kit exploit",
        "source file",
        "hacking tools",
        "hunting macro",
        "malware hosting",
        "memory scanning",
        "wild fantasy",
        "world",
        "download",
        "xxx video",
        "xxx sex",
        "desi",
        "tamil",
        "videos xxx",
        "hd posts",
        "photos pics",
        "https",
        "indicator role",
        "title added",
        "active related",
        "unknown",
        "united",
        "for privacy",
        "nxdomain",
        "meta",
        "internet gmbh",
        "creation date",
        "date",
        "audio",
        "clear hindi",
        "bhabi sex",
        "bedroom indian",
        "fakaid",
        "ww3008",
        "fingering her",
        "young boy",
        "sexy",
        "next",
        "witch",
        "filehashmd5",
        "ipv4",
        "months ago",
        "information",
        "scan endpoints",
        "all scoreblue",
        "report spam",
        "created",
        "modified",
        "zbot",
        "keyword",
        "latina",
        "teen sex",
        "jeffrey reimer",
        "reimer dpt",
        "jeff reimer sex",
        "reimer type",
        "hostname",
        "domain",
        "copyright",
        "remote",
        "t1003",
        "os credential",
        "dumping",
        "t1012",
        "t1036",
        "t1071",
        "protocol",
        "t1082",
        "as8075",
        "aaaa",
        "as30148 sucuri",
        "certificate",
        "record value",
        "body",
        "status",
        "passive dns",
        "urls",
        "hallrender",
        "brian sabey",
        "sabey xxx",
        "drive by compromise",
        "cobalt strike",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "china flag",
        "china domain",
        "files related",
        "pulses none",
        "files domain",
        "analyzer paste",
        "iocs",
        "hostnames",
        "urls https",
        "china unknown",
        "as4837 china",
        "redacted for",
        "a domains",
        "cname",
        "jeffrey reimer pt",
        "sucuri website",
        "span td",
        "time",
        "firewall",
        "win64",
        "back",
        "xtra",
        "name servers",
        "files",
        "tls web",
        "log id",
        "gmtn",
        "false",
        "ocsp",
        "ca issuers",
        "phucket news",
        "hacking",
        "registrar abuse",
        "gateway protocol abuse",
        "swipper relationship"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1428",
          "name": "Exploit Enterprise Resources",
          "display_name": "T1428 - Exploit Enterprise Resources"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1599,
        "hostname": 2988,
        "URL": 8561,
        "FileHash-SHA256": 1207,
        "email": 41,
        "FileHash-MD5": 126,
        "FileHash-SHA1": 36,
        "CVE": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 14561,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "541 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66eb1585832bcf4f494f0335",
      "name": "Telco - Swipper | Emotet and other malware spreader. BGP Bridging",
      "description": "",
      "modified": "2024-10-20T13:04:44.866000",
      "created": "2024-09-18T18:01:41.013000",
      "tags": [
        "net152",
        "net1520000",
        "loudoun county",
        "ans core",
        "nethandle",
        "as1321",
        "parkway city",
        "as701 orgnocref",
        "swipper",
        "verizon",
        "high",
        "intel",
        "icmp traffic",
        "dns query",
        "object",
        "all scoreblue",
        "filehash",
        "malware",
        "comcast",
        "cve1102",
        "actors",
        "investigation",
        "bad domains",
        "emotet am",
        "iocs",
        "first",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "webcc",
        "gmo internet",
        "csc corporate",
        "domains",
        "alibaba cloud",
        "computing",
        "beijing",
        "dynadot",
        "ltd dba",
        "china telecom",
        "group",
        "google",
        "cloudflarenet",
        "kb txtresse",
        "mb smartsaver",
        "admin cmd",
        "mb threatsniper",
        "mb history",
        "mb gadget",
        "installer",
        "referrer",
        "styes worm",
        "historical ssl",
        "script script",
        "i span",
        "ie script",
        "win64",
        "span",
        "urls",
        "levelblue labs",
        "pulses",
        "nastya",
        "meta",
        "open",
        "date",
        "vj92",
        "uagdaaeqcqaaaag",
        "ukgbagaqcqaaaae",
        "slfrd1",
        "hostnames",
        "urls http",
        "ukgbagaqcq",
        "jid1886833764",
        "jid882556742",
        "samples",
        "unknown",
        "united",
        "as20940",
        "as2914 ntt",
        "nxdomain",
        "status",
        "as6461 zayo",
        "united kingdom",
        "as15169 google",
        "as33438",
        "search",
        "creation date",
        "name servers",
        "showing",
        "hungary unknown",
        "entries",
        "scan endpoints",
        "next",
        "cape",
        "show",
        "copy",
        "emotet malware",
        "read",
        "write",
        "delete",
        "june",
        "emotet",
        "as14627",
        "passive dns",
        "ipv4",
        "pulse pulses",
        "win32",
        "months ago",
        "created",
        "modified",
        "email",
        "glupteba",
        "hostname",
        "cyber",
        "read c",
        "port",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dock",
        "execution",
        "method status",
        "url hostname",
        "ip country",
        "type get",
        "cachecontrol",
        "location https",
        "date thu",
        "gmt server",
        "code",
        "ve234 server",
        "aaaa",
        "whitelisted",
        "as44273 host",
        "as46691",
        "domain",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "trojan",
        "body"
      ],
      "references": [
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "Yara Detections: osx_GoLang",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "SLF:Trojan:Win32/Grandoreiro.A",
          "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Emotet-9951800-0",
          "display_name": "Win.Trojan.Emotet-9951800-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ca37ac60cb425a2b3856c6",
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "URL": 4635,
        "domain": 771,
        "email": 11,
        "hostname": 1993,
        "FileHash-SHA256": 3185,
        "FileHash-MD5": 113,
        "FileHash-SHA1": 101,
        "CVE": 3
      },
      "indicator_count": 10814,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "546 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d4916fa7338286448118a1",
      "name": "Jeffrey Scott Reimer DPT | Brian Sabey, SWIPPER -X.Com migration to Twitter ",
      "description": "",
      "modified": "2024-10-19T18:02:34.237000",
      "created": "2024-09-01T16:08:15.260000",
      "tags": [
        "url https",
        "filehashsha256",
        "browse scan",
        "report spam",
        "author",
        "output",
        "tsara brashears",
        "created",
        "days ago",
        "showing",
        "trojan",
        "win32",
        "msil",
        "trojanspy",
        "virtool",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "author avatar",
        "fraud",
        "june",
        "worm",
        "search",
        "tsara type",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "url http",
        "ipv6",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "sort",
        "least",
        "researched",
        "f https",
        "scan",
        "iocs",
        "learn more",
        "filehashmd5",
        "hostname",
        "domain",
        "indicators show",
        "browser",
        "unsupported",
        "view",
        "continue",
        "watch tsara",
        "searchtsa",
        "brashears",
        "most relevant",
        "porn videos",
        "download",
        "google search",
        "open threat",
        "babe",
        "green",
        "daily",
        "play",
        "fullscreen",
        "tsara",
        "videos",
        "love",
        "top tsara",
        "xxx videos",
        "hardcore porn",
        "jeffrey reimer",
        "puts",
        "porn",
        "javascript",
        "body",
        "creation date",
        "record value",
        "united",
        "gmt content",
        "gmt max",
        "age900",
        "httponly x",
        "date",
        "unknown",
        "pragma",
        "levelblue",
        "exchange open",
        "threat exchange",
        "indicator",
        "safebae",
        "get involved",
        "anyone else",
        "press",
        "data reports",
        "teen students",
        "become",
        "chapter lead",
        "become a",
        "certified peer",
        "district",
        "brian sabey",
        "sabey data",
        "hallrender",
        "sabey data centers",
        "swipper",
        "mark b sabey",
        "m brian sabey",
        "2beeg",
        "thebrotherssabey",
        "urls",
        "show",
        "cloudflarenet",
        "us urlscan",
        "skip",
        "accessibility",
        "all images",
        "videos shopping",
        "forums news",
        "web more",
        "tools",
        "service",
        "malicious",
        "size",
        "recent",
        "off blur",
        "find",
        "summary",
        "securitytrails",
        "urlscan https",
        "tryporn",
        "icann whois",
        "data problem",
        "disclaimer",
        "judaporn",
        "kompoz",
        "blur filter",
        "search results",
        "xxxvideohd",
        "hacker news",
        "item",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "september",
        "domains",
        "sale worldwide",
        "street",
        "gate parkway",
        "stateprovince",
        "postal code",
        "route",
        "open",
        "watch",
        "links",
        "footer",
        "delete see",
        "delete c",
        "tofsee",
        "grum",
        "entries",
        "cape",
        "high",
        "total",
        "copy",
        "write",
        "malware",
        "patched",
        "next",
        "please"
      ],
      "references": [
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "thebrotherssabey.wordpress.com | https://hallrender.com/attorney/brian-sabey",
        "https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://SafeBae.org |  https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://urlscan.io/domain/cdn2e-videos2.yjcontentdelivery.com | http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://www.google.com/search?client=ms-android-tcl-rvo2b&sca_esv=677ff2260c38da6a&sca_upv=1&q=tsara%20brashears&tbm=vid&source=lnms&fbs=AEQNm0Aa4sjWe7Rqy32pFwRj0UkWd8nbOJfsBGGB5IQQO6L3J5MIFhvnvU242yFxzEEp3BfRFWcyM5BvpTgNzM3vKj4sz-C2iLdc_0v0iAkScdtYjVPIGyVlvwujMCY6xcQ3LIupWIQPyPPfztGwIqpQ9H2EXqXXY4GBGq8hpekXoFuduDqktZzSriMQxAlKPjQviXaDVnUYcgWw9ejzcyECyIGanCUinw&sa=X&biw=1128&bih=1971&dpr=2&no_sw_cr=1&zx=1724209326040&sssc=1",
        "bfxxxhindi.to | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://billpay.stcu.org/csp/ws/ALKAMI-S5M/html/PC_Remote_Role_Due_XP_Help/role1_faq_email_notifications.html  billpay.stcu.org",
        "bfxxxhindi.to  www.bfxxxhindi.to  https://www.bfxxxhindi.to   tsara brashears bfxxxhindi.to https://www.bfxxxhindi.to/trend/eaUvPMTg3NzMytY07Q/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/. http://www.music-forum.org/www-cixiu888-com-tsara-brashears.html",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://alohatube.xyz/search/tsara-brashears  http://alohatube.xyz/search/tsara-brashears/",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medic",
        "http://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra-medical-center",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-medical.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/tsara-brashears-assaulted-by-jeffrey-reimer.html  http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html",
        "http://videolal.com/tsara-brashears-pueblo.html , http://videolal.com/tsara-brashears.html",
        "http://pornbitter.com/storage/tsara-brashears/  http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru",
        "http://browntubeporn.com/tsara-brashears.html  browntubeporn.com  http://pornvideoj.com/tsara-brashears.htm",
        "pornhub.com/gay/video/search?search=tsara%2Blynn%2Bbrashears%2Blesbian",
        "feestzalenvanvlaanderen.be  www.gdsl-pallemoebler.info  http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us  www.tryporn.net",
        "http://www.gdsl-pallemoebler.info/seach/tsara-brashears/ advocate-smyslova.ru  feestzalenvanvlaanderen.be www.gdsl-pallemoebler.info",
        "http://www.tryporn.net/seach/tsara-brashears/  hicksandchicks.org redpornvideos.net   http://advocate-smyslova.ru/tsara-brashears/",
        "http://flexporn.net/tsara-brashears.html  http://onlyindianporn.net/videos/tsara-brashears/  http://pornbitter.com/storage/tsara-brashears/",
        "http://pornpx.com/trends/tsara-brashears-submission-on-august-27-via-manual/1/ http://www.potnhub.org/tsara-brashears.html",
        "http://www.bukaporn.net/trend/tsara-brashears/  http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concentra",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "www.sexpornimages.com http://hicksandchicks.org/ju/tsara-brashears/  hlebo.mobi  pornpx.com  www.potnhub.org",
        "http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Language  http://www.music-forum.",
        "http://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  http://redpornvideos.net/tsara-brashears.html",
        "https://wallpapers-nature.com/  https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io   https://www.sweetheartvideo.com/tsara-brashears",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net  https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/ | https://www.sweetheartvideo.com/tsara-brashearsAccept-Language",
        "https://www.sweetheartvideo.com/tsara-brashearsAccept-Language | https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://xlxx.mobi phishing\thttps://2beeg.me   https://2beeg.net  https://www.redporn.video   https://youjizz.sex  2beeg.me xlxx.mobi ladys.one",
        "tsara-brashears-deadspin-twitter-suspended-account-help.ht  videolal.com  wallpapers-nature.com   www.sweetheartvideo.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/  Domain mom2fuck.mobi   https://youjizz.sex/tsara-brashears.html   https://youjizz.sex",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer  http://pixelrz.com/lists/keywords/brashears-tsara-buzz-news",
        "http://pixelrz.com/lists/keywords/%20dr-jeffrey-reimer-dpt-funds-tsara-brashears/ https://xlxx.mobi",
        "http://pixelrz.com/lists/keywords/dr-jeffrey-reimer-dpt-funds-tsara-brashears/  orangeporntube.net   www.tryporno.net",
        "http://pixelrz.com/lists/keywords/tsara-brashears-massage-misconduct-misconception  http://pixelrz.com/lists/keywords/tsara-brashears-dead/  http://orangeporntube.net/tsara-brashears.html",
        "http://www.tryporno.net/movies/tsara-brashears/  http://www.pixelrz.com/lists/keywords/tsara-brashears/",
        "https://kompoz.me/find/tsara-brashears-submission-on-august-27-via-manual/  sexiezpics.com",
        "http://sexiezpics.com/tsara-brashears-hardcore-porn http://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger-family",
        "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/   http://pornohata.com/mov/tsara-brashears/",
        "http://onlyindianporn2.com/videos/tsara-brashears/   onlyindianporn2.com-porn.html   aninditaannisa.blogspot.com   porno-trash.net",
        "myhotzpic.com  pornohata.com pornstarsporno.net aninditaannisa.blogspot.com/2019/02/tsara-brashears",
        "http://pornstarsporno.net/tsara-brashears.html  http://vtwctr.org/explore/inmate-tsara-brashears/",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara%20-brashears-massage-nearby.html",
        "Hostname aninditaannisa.blogspot.com No Expiration\t0\t  URL aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html  billpay.stcu.org",
        "http://hghltd.yandex.net/yandbtm?fmode=inject&url=http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "thebrotherssabey.wordpress.com http://www.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com",
        "http://go.sabey.com http://vpn2.sabey.com | http://resources.sabeydatacenters.com | http://root.sabeydatacenters.com |",
        "http://itsupport.sabey.com http://www.sabey.com | http://root.sabeydatacenters.com/ | http://server1.sabeydatacenters.com | http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com",
        "http://sabey.com/construction/ | https://tulach.cc/ | sabeydatacenters.com | https://thebrotherssabey.com | http://root.sabeydatacenters.com/ No Expiration\t0\t  URL http://server1.sabeydatacenters.com No Expiration\t0\t  URL http://smtp1.sabeydatacenters.com No Expiration\t http://smtps.sabeydatacenters.com | http://smtpseguro.sabeydatacenters.com | http://staging.sabeydatacenters.com",
        "https://info.sabeydatacenters.com/webmail/404532/1590752290/6c9ed1e0b6b364689835e8c6bd51ed2198f99ee8ec7fa1924787e4e9b6382872",
        "forceusercontent.com | sabey.com | tulach.cc | http://thebrotherssabey.com/2018m.sabeydatacenters.com | https://www.vpn.sabey.com/",
        "root.sabeydatacenters.com | server1.sabeydatacenters.com | smtps.sabeydatacenters.com | smtpseguro.sabeydatacenters.com",
        "https://thebrotherssabey.com | https://thebrotherssabey.com/2015/08/24/why | staging.sabeydatacenters.com |",
        "authsmtp.sabeydatacenters.com | go.sabey.com | thebrotherssabey.com | mx5.sabeydatacenters.com | posta.sabeydatacenters.com",
        "remote.files.downloadnow-1.com | remote.sabeydatacenters.com | poczta.sabeydatacenters.com | pop.sabeydatacenters.com",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/20",
        "https://thebrotherssabey.com/2015/08/24/why  | https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/01/18/ballroom | resources.sabeydatacenters.com | https://thebrotherssabey.com/feed/",
        "https://thebrotherssabey.com/comments/feed/ | mail2.sabeydatacenters.com | mails.sabeydatacenters.com | newmail.sabeydatacenters.com",
        "http://staging.sabeydatacenters.com | https://sabey.com/careers/ | https://vpn2.sabey.com | https://www.sabey.com | https://www.vpn.sabey.com |",
        "https://info.sabeydatacenters.com/emailPreference/epc/404532/EcSDdxFsTp4vgdAzwbcD5rWn7oROwp5s8Buq0L48dF0/732bdcab2311714bb73d4d507e6508d215afb4dbc511",
        "1a8fc49a4265fe146976/1523680312 |  https://thebrotherssabey.com/2018/04/22/the  |  https://thebrotherssabey.com/2019/07/08/suffering",
        "https://info.sabeydatacenters.com/listUnsubscribeHeader/u/404532/732bdcab2311714bb73d4d507e6508d215afb4dbc5111a8fc49a4265fe14697",
        "https://info.sabeydatacenters.com/r/404532/1/1523680312/open/1 | http://onlyindianporn2.com/videos/dia-sabey/?p=13",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/discourse | onlyindianporn2.com",
        "https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter | https://thebrotherssabey.com/author/dbsabey/",
        "https://thebrotherssabey.com/author/thebrotherssabey/ | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/2018/12/05/nature-of-scripture-part-5-conclusions/ | https://thebrotherssabey.com/2019/08/01/why",
        "mypornvid.fun | porn100.tv | amp.mypornvid.fun | cdn10.mypornvid.fun | cdn11.mypornvid.fun | cdn5.mypornvid.fun | cdn8.mypornvid.fun",
        "www.anyxxxtube.net | sv2.mypornvid.fun | www.porn100.tv | www.redporn.video | https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing |",
        "http://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears",
        "anybunny.tv | http://anybunny.tv/search/eva-lisa | http://anybunny.tv/search/tsara-brashears-submission-on-august-27-via-manual.html&us",
        "https://videolal.co/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-nearby.html. |",
        "http://onlyindianporn.tv/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-concent | http://wapwon.live/category/tsara-brashears-assaulted-by-jeffrey-reimerAccept-Languauge",
        "onlyindianporn.tv | sexpornimages.com | http://www.sexpornimages.com/hillary/hillary-clinton",
        "https://mypornvid.fun/videos/3/o00vnGgcVx0/dude-sex-fuck-a-deer-wapporn-video-com/fuck-deer",
        "http://www.sexpornimages.com/tsara/tsara-lynn-brashears-porn/7x56y.html",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead/ | http://videolal.com/tsara-brashears-dead-by-daylight.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html | http://videolal.com/tsara-brashears-dead.html |",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/2019/01/20/miracle/",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html | tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://thebrotherssabey.com/2018/12/05/nature | https://thebrotherssabey.com/2017/04/17/truth",
        "https://thebrotherssabey.com/2016/03/12/how | https://thebrotherssabey.com/2016/01/18/ballroom",
        "https://thebrotherssabey.com/comments/feed/ | https://thebrotherssabey.com/category/pregnancy",
        "https://thebrotherssabey.com/feed/ | https://thebrotherssabey.com/discourse | https://thebrotherssabey.com/comments/feed/",
        "https://thebrotherssabey.com/2015/08/24/why | https://thebrotherssabey.com/20 | https://thebrotherssabey.com | https://thebrotherssabey.com",
        "http://thebrotherssabey.com/2018 | https://thebrotherssabey.com/2019/01/20/miracle/ | https://thebrotherssabey.com/2019/07/08/suffering",
        "https://thebrotherssabey.com/category/pregnancy | https://thebrotherssabey.com/category/homosexuality",
        "https://thebrotherssabey.com/author/thebrotherssabey/  | https://thebrotherssabey.com/author/dbsabey/",
        "http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/ | https://www.applefilmaker.com | https://www.applefilmaker.com/1odbU3D",
        "www.wwwgitlab.gitlab.git.git.gitlab.git.128-199-7-137.cprapid.com",
        "https://thebrotherssabey.wordpress.com/wp-admin/customize.php?url=https://thebrotherssabey.wordpress.com/",
        "https://hallrender.com/attorney/brian-sabey | https://thebrotherssabey.com/2019/01/20/miracle/?share=twitter",
        "storage.ladys.one ladys.one: | http://photos.ladys.one ladys.one: | http://porno.ladys.one ladys.one: | http://storage.ladys.one ladys.one: | http://xxx-videos.ladys.one ladys.one:",
        "http://www.xvxx.me/clips/nadia-ali-hardcore/199530/",
        "https://kompoz2.com/tv/454575/blonde-slut-sara-jay-with-big-ass-is-fucked-in-doggy-style.html",
        "http://onlyindianporn2.com/videos/vichatter-young-11//title/0.7292669771257236"
      ],
      "public": 1,
      "adversary": "Brian Sabey | Tulach | Sabey Data Centers",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Win32/Tofsee.AX",
          "display_name": "Win32/Tofsee.AX",
          "target": null
        },
        {
          "id": "Trojan:Win32/Muldrop",
          "display_name": "Trojan:Win32/Muldrop",
          "target": "/malware/Trojan:Win32/Muldrop"
        }
      ],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1055.013",
          "name": "Process Doppelg\u00e4nging",
          "display_name": "T1055.013 - Process Doppelg\u00e4nging"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ccbd92f716bb0ca0fda93d",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 121,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 935,
        "URL": 5882,
        "domain": 571,
        "hostname": 1418,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 9054,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "547 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://vcards.hallrender.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://vcards.hallrender.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630473.6591065
}