{
  "type": "URL",
  "indicator": "https://vpn-jp.keke125.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://vpn-jp.keke125.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4106860667,
      "indicator": "https://vpn-jp.keke125.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "69c7c21eb54e86a517154a5b",
          "name": "meg.ns.cloudflare.com #abuseofpower",
          "description": "The full text of the full report on the \"Pulses\" phenomenon has been published online by CloudFlare.com, the company that runs the web service for the US government's internet service.<<<< NOT OK.",
          "modified": "2026-03-30T02:53:43.786000",
          "created": "2026-03-28T11:57:18.700000",
          "tags": [
            "as13335",
            "united",
            "unknown",
            "status",
            "aaaa",
            "passive dns",
            "ip address",
            "creation date",
            "date",
            "expiration date",
            "record type",
            "ttl value",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus ogoogle",
            "trust",
            "cnwe1 validity",
            "subject public",
            "key info",
            "data redacted",
            "domain status",
            "server",
            "code",
            "registrar abuse",
            "registrant fax",
            "contact phone",
            "registrar url",
            "admin postal",
            "cloudflare",
            "general",
            "dns server",
            "dns asap",
            "ip range",
            "github gist",
            "mail server",
            "priority",
            "revalidate",
            "information",
            "thumbprint",
            "unicode text",
            "utf8 text",
            "dynamic etag"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv6": 9,
            "domain": 442,
            "IPv4": 55,
            "URL": 217,
            "email": 11,
            "hostname": 174,
            "FileHash-MD5": 107,
            "FileHash-SHA1": 116,
            "FileHash-SHA256": 220,
            "CIDR": 1,
            "CVE": 3
          },
          "indicator_count": 1355,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "20 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6958780c8479a9d69920c3d8",
          "name": "Telnet - Mirai \u2022 Dark Nexus BusyBox iOS Attack",
          "description": "There\u2019s enough here to cause an outage. I will stop here. Illegal activities to silence victim and block her from financial settlement award for permanent injuries under workers compensation in a premise and healthcare worker assault scenario. Attorneys estimated her case to be above $100 million but knew she\u2019d be tampered with. Mark Montano MD  forewarned her but is culpable. Still attacking family of victim.\n[ True- otx auto generated: Adversaries may be able to gain access to a victim's network through a drive-by attack, as well as using a short-term SSL certificate, in order to target the victim.] |||\nPositive:\nT1140 - Deobfuscate/Decode Files or Information\nSuspicious IP Address\n104.21.51.140, 172.67.181.41\nLocation United States ASN\nModif AS13335 cloudflare\nAutomate Nameservers:\nns1.colocrossing.com.",
          "modified": "2026-02-02T01:02:46.327000",
          "created": "2026-01-03T01:59:40.530000",
          "tags": [
            "united",
            "moved",
            "title",
            "passive dns",
            "ipv4 add",
            "urls",
            "files",
            "hosting",
            "reverse dns",
            "location united",
            "hash avast",
            "avg clamav",
            "msdefender mar",
            "read c",
            "create c",
            "medium",
            "search",
            "memcommit",
            "high",
            "checks",
            "windows",
            "execution",
            "dock",
            "write",
            "persistence",
            "capture",
            "local",
            "ref b",
            "wed may",
            "backdoor",
            "mtb aug",
            "next associated",
            "mtb dec",
            "twitter",
            "smoke loader",
            "malware",
            "virtool",
            "hacktool",
            "data upload",
            "present dec",
            "mtb apr",
            "win32",
            "trojan",
            "worm",
            "lowfi",
            "cybota",
            "expiration date",
            "name servers",
            "ipv4",
            "url analysis",
            "port",
            "destination",
            "telnet login",
            "bad login",
            "gpl telnet",
            "suspicious path",
            "busybox",
            "tcp syn",
            "et telnet",
            "path",
            "mirai",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "america",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "learn",
            "t1179 hooking",
            "installs",
            "t1035 service",
            "adversaries",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "y013",
            "flag",
            "span",
            "accept",
            "core",
            "february",
            "hybrid",
            "malicious",
            "general",
            "click",
            "strings",
            "roboto",
            "next",
            "usa windows",
            "finished",
            "queueprogress",
            "timestamp input",
            "threat level",
            "october",
            "september",
            "hwp support",
            "fresh",
            "win64",
            "khtml",
            "gecko",
            "brand",
            "microsoft edge",
            "programfiles",
            "comspec",
            "model",
            "iframe",
            "form",
            "listeners",
            "initial access",
            "t1590 gather",
            "victim network",
            "ssl certificate",
            "quasi government",
            "jeffrey reimer",
            "palantir",
            "Regis university",
            "otx hp",
            "apple",
            "pegasus",
            "h5 data center",
            "florence colorado",
            "brian sabey",
            "target : Tsara Brasheaers",
            "aig",
            "industry and commerce",
            "united states",
            "State of Colorado.",
            "date",
            "status",
            "domain",
            "hostname add",
            "pulse pulses",
            "files ip",
            "address",
            "url https",
            "url http",
            "hostname",
            "show",
            "type indicator",
            "source hostname",
            "entries",
            "Prometheus Intelligence Technology",
            "pulse submit",
            "america flag",
            "body",
            "dynamicloader",
            "microsoft azure",
            "tls issuing",
            "named pipe",
            "json",
            "ascii text",
            "lredmond",
            "Apple",
            "Telnet",
            "BusyBox",
            "Pegasus",
            "Colorado State Fixer: Christopher P. Ahmann",
            "Hijacker: Brian Sabey",
            "For: Concentra",
            "Protecting Assaulter: Jeffrey Reimer",
            "For: AIG",
            "For Industry and Commerce",
            "For: Quasi Government",
            "For: Workers Compensation",
            "Authorities",
            "Law Enforcement Dark",
            "Silencing",
            "Tampering with a Victim",
            "Meta",
            "Palantir",
            "Google",
            "Bing",
            "Microsoft",
            "ColoCrossing",
            "Associates",
            "hit men"
          ],
          "references": [
            "ET Telnet |  https://www.colocrossing.com | velocity servers",
            "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives",
            "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host",
            "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)",
            "(legitimate services will remain up-and-running usually) High |  ID dead_host",
            "ELF:Mirai-GH\\ [Trj] ,  Unix.Trojan.DarkNexus-7679166-0",
            "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login",
            "Yara Detections is__elf",
            "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
            "Yara Detections is__elf ,  ELFHighEntropy ,  elf_empty_sections",
            "http://appleid.apple.com.msg206.site/   http://www.icloud.com.msg206.site/   https://appleid.apple.com.msg206.site/",
            "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l",
            "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!",
            "https://www.colocrossing.com/",
            "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.",
            "In all seriousness. The severity of  injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov",
            "104.21.51.140, 172.67.181.41",
            "Detections Win.Packed.ImminentMonitorRAT-9892275-0 ,  HackTool:MSIL/Boilod.C!bit",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot",
            "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile  injection_runpe",
            "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download",
            "Alerts: dynamic_function_loading ipc_namedpipe  createtoolhelp32snapshot_module_enumeration",
            "IP\u2019s Contacted: 142.250.147.101  88.221.104.56  13.33.141.29  35.186.249.72  151.101.1.192",
            "IP\u2019s Contacted 178.249.97.99  178.249.97.98  178.249.97.23  84.53.172.74  88.221.104.82",
            "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com",
            "This is hard to comprehend or put into indelible words."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Unix.Trojan.DarkNexus-7679166-0",
              "display_name": "Unix.Trojan.DarkNexus-7679166-0",
              "target": null
            },
            {
              "id": "HackTool:MSIL/Boilod.C!bit",
              "display_name": "HackTool:MSIL/Boilod.C!bit",
              "target": "/malware/HackTool:MSIL/Boilod.C!bit"
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1098",
              "name": "Account Manipulation",
              "display_name": "T1098 - Account Manipulation"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1462",
              "name": "Malicious Software Development Tools",
              "display_name": "T1462 - Malicious Software Development Tools"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [
            "Technology",
            "Healthcare",
            "Insurance",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6390,
            "domain": 723,
            "hostname": 1978,
            "FileHash-SHA256": 1912,
            "FileHash-MD5": 410,
            "FileHash-SHA1": 306,
            "email": 3,
            "SSLCertFingerprint": 28,
            "CVE": 3
          },
          "indicator_count": 11753,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "76 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6935c92c5fc93fd873c6aa6d",
          "name": "[COINBASECARTEL] - Ransomware Victim: Cinvestav - RedPacket Security | CVE-2025-11727 (New)",
          "description": "Related to multiple exploits. Government Cyber Defense implications but shows as very legitimate looking masquerading. I am not positive and don\u2019t want to move to Belfast. Populated NSA [.] gov domains and subdomains (w/o no headers) lightly researched but does not assert a government identity. \n*New CVE-2025-11727",
          "modified": "2026-01-06T18:04:02.620000",
          "created": "2025-12-07T18:36:28.055000",
          "tags": [
            "memcommit",
            "read c",
            "t1082",
            "cryptexportkey",
            "invalid pointer",
            "write",
            "msil",
            "malware",
            "media",
            "autorun",
            "countries",
            "united",
            "america",
            "high defense",
            "evasion",
            "t1055",
            "ck technique",
            "technique id",
            "allocates",
            "potential code",
            "attempts",
            "threatintel",
            "dark web",
            "coinbasecartel",
            "ransomware",
            "osint",
            "tor",
            "data breach",
            "cinvestav",
            "ai generated",
            "ransomware leak",
            "page",
            "november",
            "investigacin y",
            "nacional",
            "mexican",
            "mexico",
            "present nov",
            "verdana",
            "td tr",
            "passive dns",
            "ip address",
            "urls",
            "aaaa",
            "present may",
            "present oct",
            "present jul",
            "virtool",
            "present sep",
            "present jun",
            "win32",
            "default",
            "unicode",
            "png image",
            "rgba",
            "high",
            "dock",
            "execution",
            "xport",
            "unknown",
            "data upload",
            "extraction",
            "will",
            "data",
            "name cloudflare",
            "hostmaster name",
            "org cloudflare",
            "townsend st",
            "city san",
            "us creation",
            "kelihos",
            "ipv4",
            "present dec",
            "files",
            "domain",
            "search",
            "hostname",
            "verdict",
            "location united",
            "asn as16625",
            "akamai",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results nov",
            "present aug",
            "backdoor",
            "msie",
            "chrome",
            "trojan",
            "mtb aug",
            "worm",
            "cryp",
            "junkpoly",
            "twitter",
            "trojandropper",
            "title",
            "germany unknown",
            "ipv4 add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "cologne",
            "search engine",
            "gse compromised",
            "redacted for",
            "privacy admin",
            "privacy tech",
            "server",
            "organization",
            "street",
            "city",
            "stateprovince",
            "postal code",
            "country",
            "resolver domain",
            "cape sa",
            "virustot",
            "type pdf",
            "name",
            "lookups",
            "email abuse",
            "historical ssl",
            "certificates",
            "first",
            "graph summary",
            "cname",
            "address",
            "ip2location",
            "bogon ip",
            "admin",
            "network",
            "wifi password",
            "ssid",
            "demo",
            "details",
            "failed",
            "include review",
            "exclude sugges",
            "onlv",
            "x try",
            "find s",
            "typ url",
            "url data",
            "severity att",
            "module load",
            "icmp traffic",
            "dns query",
            "t1055 jseval",
            "windows nt",
            "port",
            "entries",
            "destination",
            "medium",
            "show",
            "pecompact",
            "june",
            "service",
            "next",
            "xserver",
            "encrypt",
            "t1129",
            "windows module",
            "dlls",
            "convention",
            "windows native"
          ],
          "references": [
            "Search Engines \u2022 Browser Extensions | Google.com.? | Duck DNS",
            "Related : Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
            "hallplan.vm05.iveins.de",
            "https://otx.alienvault.com/pulse/65b85faa9b8e3e1206d7f25c",
            "Masquerading as?  : bitcoin-king.nsa.mx  \u2022 cpcontacts.nsa.mx  \u2022 vulkanslot-bet777.nsa.mx",
            "Name : iveins.de  Service : connect",
            "https://www.redpacketsecurity.com/coinbasecartel-ransomware-victim-cinvestav \u2022 evilginx.redpacketsecurity.com",
            "phish-demo-poc.phish-demo-poc.redpacketsecurity.com \u2022 phish-demo-poc.redpacketsecurity.com",
            "https://otx.alienvault.com/indicator/cve/CVE-2025-11727"
          ],
          "public": 1,
          "adversary": "COINBASECARTEL",
          "targeted_countries": [
            "United States of America",
            "Sweden",
            "Bangladesh",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Tiggre!rfn",
              "display_name": "Trojan:Win32/Tiggre!rfn",
              "target": "/malware/Trojan:Win32/Tiggre!rfn"
            },
            {
              "id": "MSIL:Agent-DQ\\ [Trj]",
              "display_name": "MSIL:Agent-DQ\\ [Trj]",
              "target": null
            },
            {
              "id": "VirTool:MSIL/Covent.A",
              "display_name": "VirTool:MSIL/Covent.A",
              "target": "/malware/VirTool:MSIL/Covent.A"
            },
            {
              "id": "Trojan:Win32/Pynamer!rfn",
              "display_name": "Trojan:Win32/Pynamer!rfn",
              "target": "/malware/Trojan:Win32/Pynamer!rfn"
            },
            {
              "id": "Win64:TrojanX",
              "display_name": "Win64:TrojanX",
              "target": null
            },
            {
              "id": "VirTool:MSIL/Covent",
              "display_name": "VirTool:MSIL/Covent",
              "target": "/malware/VirTool:MSIL/Covent"
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
              "display_name": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
              "target": null
            },
            {
              "id": "Win32:Malware",
              "display_name": "Win32:Malware",
              "target": null
            },
            {
              "id": "Kelihos",
              "display_name": "Kelihos",
              "target": null
            },
            {
              "id": "CVE-2025-11727",
              "display_name": "CVE-2025-11727",
              "target": null
            },
            {
              "id": "Exploit:JS/CVE-2014-0322",
              "display_name": "Exploit:JS/CVE-2014-0322",
              "target": "/malware/Exploit:JS/CVE-2014-0322"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1098",
              "name": "Account Manipulation",
              "display_name": "T1098 - Account Manipulation"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            }
          ],
          "industries": [
            "Education"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 1746,
            "URL": 5018,
            "hostname": 1827,
            "domain": 1072,
            "CVE": 3,
            "email": 2,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 9938,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "102 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6919473b9e0624394e9b68e9",
          "name": "Backdoor:Linux/DemonBot Affecting Unsecured servers",
          "description": "A closer look at a hacker group found in  Mirai Bot Network. Catgirls is still active , has running web server , is  only viewable to group according to remarks regarding \u2018catgirls\u2019 domains , sub domains , hosts.\n\n Multiple hosts , name servers and links. .Backdoor:Linux/DemonBot Malicious attacks affecting unsecured servers  (personal , business) networks, DDOS attacks , Mitre. Worm, Ransomware. \n\nHacker group has seemingly caused a fair ammunition of damage to small businesses and / or individuals/civil society.. Seen in attacks against handful of targets are in this Mirai Botnet. Of course we know how very large the  Mirai Botnet is.",
          "modified": "2025-12-16T03:02:09.743000",
          "created": "2025-11-16T03:38:35.430000",
          "tags": [
            "server",
            "algorithm",
            "x509v3 subject",
            "registrar abuse",
            "v3 serial",
            "spaceship",
            "community",
            "related pulses",
            "cidr",
            "mirai botnet",
            "hacker",
            "mirai att",
            "ck id",
            "group",
            "active",
            "generic pong",
            "reporting arch",
            "msie",
            "windows nt",
            "resolverror",
            "backdoor",
            "malware",
            "strings",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "evasion att",
            "t1480 execution",
            "ipv4",
            "iocs",
            "drop",
            "review iocs",
            "found",
            "ascii text",
            "pattern match",
            "mitre att",
            "beginstring",
            "null",
            "refresh",
            "span",
            "hybrid",
            "click",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "moved",
            "passive dns",
            "urls",
            "record value",
            "unknown aaaa",
            "gmt content",
            "title",
            "cookie",
            "signing defense",
            "t1553 technique",
            "subvert trust",
            "controls learn",
            "disable",
            "modify tools",
            "defense evasion",
            "t1562 technique",
            "rdap",
            "domain database",
            "dap domain",
            "datab",
            "database",
            "array",
            "content",
            "ascii",
            "form",
            "initial access",
            "execution",
            "present aug",
            "present jul",
            "present nov",
            "present oct",
            "ip address",
            "command decode",
            "suricata ipv4",
            "localappdata",
            "windir",
            "openurl c",
            "programfiles",
            "edge",
            "cloudflare",
            "ssl certificate",
            "size",
            "starfield",
            "accept",
            "path",
            "general",
            "local",
            "hostname add",
            "pulse pulses",
            "read c",
            "port",
            "destination",
            "rgba",
            "unicode text",
            "medium",
            "unknown",
            "code",
            "write",
            "pecompact",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "crash",
            "next",
            "china unknown",
            "chrome",
            "internal server",
            "next associated",
            "ipv4 add",
            "trojandropper",
            "date",
            "domain",
            "search",
            "domain add",
            "certificate",
            "next http",
            "scans show",
            "found title",
            "head body",
            "hostname",
            "files",
            "files ip",
            "address",
            "location united",
            "asn asnone",
            "present feb",
            "present jun",
            "unknown ns",
            "internet",
            "emails",
            "present sep",
            "show",
            "memcommit",
            "gapd5d",
            "key0",
            "packing t1045",
            "filehash",
            "sha1 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "medium risk",
            "mirai",
            "json",
            "total",
            "delete",
            "win64",
            "url http",
            "http",
            "related nids",
            "files location",
            "flag united",
            "gmt cache",
            "pulse submit",
            "url analysis",
            "verdict",
            "win32dh",
            "reverse dns",
            "america flag",
            "worm",
            "warehouse mgmt",
            "built",
            "retailexperts",
            "read",
            "top source",
            "top destination",
            "aaaa",
            "ransom",
            "trojan",
            "entries",
            "singapore",
            "singapore asn",
            "as16509",
            "present mar",
            "creation date",
            "contacted",
            "hostile",
            "targeting",
            "whitelisted",
            "high",
            "systemroot",
            "as15169",
            "copy",
            "global",
            "dynamicloader",
            "directui",
            "yara rule",
            "element",
            "classinfobase",
            "ccbase",
            "hwndhost",
            "windows"
          ],
          "references": [
            "http://catgirls.foundation/main \u2022 https://spaceship.com/",
            "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f",
            "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2",
            "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2"
          ],
          "public": 1,
          "adversary": "Mirai",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Linux/DemonBot.Aa!MTB",
              "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
              "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
            },
            {
              "id": "Mirai (ELF)",
              "display_name": "Mirai (ELF)",
              "target": null
            },
            {
              "id": "Backdoor:Linux/Mirai",
              "display_name": "Backdoor:Linux/Mirai",
              "target": "/malware/Backdoor:Linux/Mirai"
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "PSW.Sinowal.X",
              "display_name": "PSW.Sinowal.X",
              "target": null
            },
            {
              "id": "mirai",
              "display_name": "mirai",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Win.Virus.PolyRansom-5704625-0",
              "display_name": "Win.Virus.PolyRansom-5704625-0",
              "target": null
            },
            {
              "id": "Worm:Win32/Locksky.gen!A",
              "display_name": "Worm:Win32/Locksky.gen!A",
              "target": "/malware/Worm:Win32/Locksky.gen!A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1991,
            "domain": 428,
            "hostname": 882,
            "FileHash-SHA256": 2213,
            "FileHash-MD5": 675,
            "FileHash-SHA1": 530,
            "email": 7,
            "CIDR": 1,
            "CVE": 1,
            "SSLCertFingerprint": 23
          },
          "indicator_count": 6751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "124 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893eee9bf1b30e08d1a6d8e",
          "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
          "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
          "modified": "2025-09-05T23:02:52.811000",
          "created": "2025-08-07T00:10:17.696000",
          "tags": [
            "address google",
            "safe browsing",
            "united",
            "typeof",
            "passive dns",
            "body doctype",
            "nreum",
            "date",
            "gmt server",
            "apache x",
            "cnection",
            "content type",
            "span",
            "ok transfer",
            "encoding",
            "x powered",
            "unknown soa",
            "unknown ns",
            "showing",
            "entries",
            "next associated",
            "urls show",
            "body",
            "encrypt",
            "search",
            "ip address",
            "creation date",
            "record value",
            "present jul",
            "present may",
            "present apr",
            "certificate",
            "present aug",
            "present feb",
            "present dec",
            "present nov",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "ascii text",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "itre att",
            "accept",
            "sha256",
            "size",
            "type data",
            "utf8 text",
            "document file",
            "flag",
            "server",
            "european union",
            "name server",
            "tor analysis",
            "dns requests",
            "domain address",
            "ii llc",
            "windir",
            "openurl c",
            "prefetch2",
            "show process",
            "ogoogle trust",
            "network traffic",
            "organization",
            "elton avundano",
            "object",
            "title object",
            "header http2",
            "returnurl",
            "texas",
            "rsa ov",
            "ssl ca",
            "status",
            "australia",
            "netherlands",
            "urls",
            "gmt path",
            "hostname add",
            "pulse submit",
            "present oct",
            "e safe",
            "results jul",
            "response ip",
            "present jan",
            "name servers",
            "verdict",
            "domain",
            "files ip",
            "address domain",
            "xhr start",
            "xhr load",
            "aaaa",
            "read c",
            "show",
            "port",
            "destination",
            "high",
            "delete",
            "outbound m3",
            "copy",
            "write",
            "persistence",
            "execution",
            "malware",
            "generic",
            "unknown",
            "present mar",
            "dynamicloader",
            "wine emulator",
            "dynamic",
            "medium",
            "read",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "dnssec",
            "domain name",
            "solutions",
            "llc status",
            "next passive",
            "dns status",
            "hostname query",
            "files show",
            "date hash",
            "avast avg",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "virtool",
            "win64",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "file discovery",
            "utf8",
            "crlf line",
            "a domains",
            "script urls",
            "link",
            "unknown aaaa",
            "meta",
            "atom",
            "results jan",
            "present",
            "present sep",
            "akamai",
            "asn as16625",
            "less whois",
            "registrar",
            "http",
            "france flag",
            "france hostname",
            "files related",
            "url analysis",
            "files",
            "location france",
            "detailed error",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "name",
            "perfect privacy",
            "error jul",
            "next related",
            "domains show",
            "domain related",
            "url add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "france asn",
            "as16276",
            "dns resolutions",
            "datacenter",
            "regopenkeyexa",
            "regsetvalueexa",
            "windows nt",
            "regdword",
            "hostile",
            "service",
            "delphi",
            "next",
            "pulses none",
            "related tags",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "review",
            "data upload",
            "extraction",
            "khtml",
            "gecko",
            "olet",
            "cnlet",
            "tlsv1",
            "hacktool",
            "push",
            "ms windows",
            "intel",
            "pe32",
            "users",
            "precreate read",
            "ransom",
            "code",
            "installer",
            "june",
            "media",
            "autorun",
            "next yara",
            "detections name",
            "aspackv2xxx",
            "eu alexey",
            "alerts",
            "pe file",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "yara detections",
            "analysis date",
            "april",
            "packing t1045",
            "t1045",
            "t1060",
            "registry run",
            "keys",
            "user execution",
            "icmp traffic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1132,
            "URL": 6245,
            "hostname": 2264,
            "FileHash-SHA256": 1857,
            "FileHash-SHA1": 491,
            "email": 9,
            "FileHash-MD5": 573,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 12587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6891980740656e8b21b31d0a",
          "name": "Tracker | Mirai | Virtool | Tofsee | Phishing +",
          "description": "Tracker found in \u2018alleged \u2018 Jefferson County, Co website also a single link was found in a collection of phishing websites by a OTX researcher in 2023. \nI can\u2019t comment much. \n#overreach\n#https://reviewable.io/reviews/palantir/godel-conjure-plugin/549",
          "modified": "2025-09-04T05:03:13.563000",
          "created": "2025-08-05T05:35:03.786000",
          "tags": [
            "url https",
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "date",
            "for privacy",
            "redacted for",
            "status",
            "hostname add",
            "pulse submit",
            "url analysis",
            "files",
            "united",
            "entries",
            "search",
            "unknown aaaa",
            "overview ip",
            "address",
            "location united",
            "asn as35916",
            "whois registrar",
            "showing",
            "next associated",
            "meta http",
            "content",
            "index",
            "th th",
            "443 ma2592000",
            "body",
            "ip address",
            "asn as54113",
            "name servers",
            "expiration date",
            "resources whois",
            "urlvoid",
            "related",
            "comments",
            "whois show",
            "present jun",
            "script urls",
            "enom",
            "record value",
            "certificate",
            "formbook cnc",
            "checkin",
            "neue",
            "ipv4",
            "exploit",
            "trojan",
            "virtool",
            "ransom",
            "win32",
            "ipv4 add",
            "unknown cname",
            "unknown ns",
            "script domains",
            "meta",
            "config",
            "associated urls",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next http",
            "present may",
            "present oct",
            "present jul",
            "aaaa",
            "present sep",
            "domain",
            "creation date",
            "expiration",
            "url http",
            "present dec",
            "present jan",
            "reverse dns",
            "present mar",
            "present nov",
            "a domains",
            "verdict",
            "files ip",
            "next related",
            "domains show",
            "domain related",
            "cryp",
            "date hash",
            "avast avg",
            "entries related",
            "mtb may",
            "trojandropper",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "files show",
            "none google",
            "safe browsing",
            "death",
            "indicator facts",
            "historical otx",
            "twitter running",
            "open ports",
            "memcommit",
            "medium",
            "read c",
            "post http",
            "delete",
            "windows nt",
            "malware",
            "copy",
            "write",
            "msie",
            "chrome",
            "backdoor",
            "junkpoly",
            "worm"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4488,
            "hostname": 1442,
            "domain": 746,
            "email": 6,
            "FileHash-SHA256": 1122,
            "FileHash-MD5": 345,
            "FileHash-SHA1": 337,
            "CVE": 2
          },
          "indicator_count": 8488,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "This is hard to comprehend or put into indelible words.",
        "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download",
        "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2",
        "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.",
        "(legitimate services will remain up-and-running usually) High |  ID dead_host",
        "ET Telnet |  https://www.colocrossing.com | velocity servers",
        "Search Engines \u2022 Browser Extensions | Google.com.? | Duck DNS",
        "In all seriousness. The severity of  injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov",
        "Masquerading as?  : bitcoin-king.nsa.mx  \u2022 cpcontacts.nsa.mx  \u2022 vulkanslot-bet777.nsa.mx",
        "Detections Win.Packed.ImminentMonitorRAT-9892275-0 ,  HackTool:MSIL/Boilod.C!bit",
        "Name : iveins.de  Service : connect",
        "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)",
        "https://otx.alienvault.com/indicator/cve/CVE-2025-11727",
        "https://www.redpacketsecurity.com/coinbasecartel-ransomware-victim-cinvestav \u2022 evilginx.redpacketsecurity.com",
        "Yara Detections is__elf",
        "Related : Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
        "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host",
        "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login",
        "104.21.51.140, 172.67.181.41",
        "https://www.colocrossing.com/",
        "ELF:Mirai-GH\\ [Trj] ,  Unix.Trojan.DarkNexus-7679166-0",
        "hallplan.vm05.iveins.de",
        "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!",
        "Yara Detections is__elf ,  ELFHighEntropy ,  elf_empty_sections",
        "Alerts: dynamic_function_loading ipc_namedpipe  createtoolhelp32snapshot_module_enumeration",
        "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot",
        "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile  injection_runpe",
        "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f",
        "phish-demo-poc.phish-demo-poc.redpacketsecurity.com \u2022 phish-demo-poc.redpacketsecurity.com",
        "IP\u2019s Contacted 178.249.97.99  178.249.97.98  178.249.97.23  84.53.172.74  88.221.104.82",
        "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l",
        "http://catgirls.foundation/main \u2022 https://spaceship.com/",
        "IP\u2019s Contacted: 142.250.147.101  88.221.104.56  13.33.141.29  35.186.249.72  151.101.1.192",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "http://appleid.apple.com.msg206.site/   http://www.icloud.com.msg206.site/   https://appleid.apple.com.msg206.site/",
        "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "https://otx.alienvault.com/pulse/65b85faa9b8e3e1206d7f25c"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Mirai",
            "COINBASECARTEL"
          ],
          "malware_families": [
            "Backdoor:linux/demonbot.aa!mtb",
            "Exploit:js/cve-2014-0322",
            "Psw.sinowal.x",
            "Msil:agent-dq\\ [trj]",
            "Trojan:win32/tiggre!rfn",
            "Virtool:msil/covent",
            "Trojan:win32/pynamer!rfn",
            "Kelihos",
            "Win.virus.polyransom-5704625-0",
            "Win64:trojanx",
            "Hacktool:msil/boilod.c!bit",
            "#lowfi:hstr:msil/obfuscator.deepsea",
            "Virtool:msil/covent.a",
            "Mirai",
            "Win32:malware",
            "Mirai (elf)",
            "Other malware",
            "Worm:win32/locksky.gen!a",
            "Unix.trojan.darknexus-7679166-0",
            "Cve-2025-11727",
            "Backdoor:linux/mirai",
            "Tofsee"
          ],
          "industries": [
            "Healthcare",
            "Education",
            "Insurance",
            "Technology",
            "Civil society"
          ],
          "unique_indicators": 48586
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/keke125.com",
    "whois": "http://whois.domaintools.com/keke125.com",
    "domain": "keke125.com",
    "hostname": "vpn-jp.keke125.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "69c7c21eb54e86a517154a5b",
      "name": "meg.ns.cloudflare.com #abuseofpower",
      "description": "The full text of the full report on the \"Pulses\" phenomenon has been published online by CloudFlare.com, the company that runs the web service for the US government's internet service.<<<< NOT OK.",
      "modified": "2026-03-30T02:53:43.786000",
      "created": "2026-03-28T11:57:18.700000",
      "tags": [
        "as13335",
        "united",
        "unknown",
        "status",
        "aaaa",
        "passive dns",
        "ip address",
        "creation date",
        "date",
        "expiration date",
        "record type",
        "ttl value",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus ogoogle",
        "trust",
        "cnwe1 validity",
        "subject public",
        "key info",
        "data redacted",
        "domain status",
        "server",
        "code",
        "registrar abuse",
        "registrant fax",
        "contact phone",
        "registrar url",
        "admin postal",
        "cloudflare",
        "general",
        "dns server",
        "dns asap",
        "ip range",
        "github gist",
        "mail server",
        "priority",
        "revalidate",
        "information",
        "thumbprint",
        "unicode text",
        "utf8 text",
        "dynamic etag"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv6": 9,
        "domain": 442,
        "IPv4": 55,
        "URL": 217,
        "email": 11,
        "hostname": 174,
        "FileHash-MD5": 107,
        "FileHash-SHA1": 116,
        "FileHash-SHA256": 220,
        "CIDR": 1,
        "CVE": 3
      },
      "indicator_count": 1355,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "20 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6958780c8479a9d69920c3d8",
      "name": "Telnet - Mirai \u2022 Dark Nexus BusyBox iOS Attack",
      "description": "There\u2019s enough here to cause an outage. I will stop here. Illegal activities to silence victim and block her from financial settlement award for permanent injuries under workers compensation in a premise and healthcare worker assault scenario. Attorneys estimated her case to be above $100 million but knew she\u2019d be tampered with. Mark Montano MD  forewarned her but is culpable. Still attacking family of victim.\n[ True- otx auto generated: Adversaries may be able to gain access to a victim's network through a drive-by attack, as well as using a short-term SSL certificate, in order to target the victim.] |||\nPositive:\nT1140 - Deobfuscate/Decode Files or Information\nSuspicious IP Address\n104.21.51.140, 172.67.181.41\nLocation United States ASN\nModif AS13335 cloudflare\nAutomate Nameservers:\nns1.colocrossing.com.",
      "modified": "2026-02-02T01:02:46.327000",
      "created": "2026-01-03T01:59:40.530000",
      "tags": [
        "united",
        "moved",
        "title",
        "passive dns",
        "ipv4 add",
        "urls",
        "files",
        "hosting",
        "reverse dns",
        "location united",
        "hash avast",
        "avg clamav",
        "msdefender mar",
        "read c",
        "create c",
        "medium",
        "search",
        "memcommit",
        "high",
        "checks",
        "windows",
        "execution",
        "dock",
        "write",
        "persistence",
        "capture",
        "local",
        "ref b",
        "wed may",
        "backdoor",
        "mtb aug",
        "next associated",
        "mtb dec",
        "twitter",
        "smoke loader",
        "malware",
        "virtool",
        "hacktool",
        "data upload",
        "present dec",
        "mtb apr",
        "win32",
        "trojan",
        "worm",
        "lowfi",
        "cybota",
        "expiration date",
        "name servers",
        "ipv4",
        "url analysis",
        "port",
        "destination",
        "telnet login",
        "bad login",
        "gpl telnet",
        "suspicious path",
        "busybox",
        "tcp syn",
        "et telnet",
        "path",
        "mirai",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "america",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "learn",
        "t1179 hooking",
        "installs",
        "t1035 service",
        "adversaries",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "y013",
        "flag",
        "span",
        "accept",
        "core",
        "february",
        "hybrid",
        "malicious",
        "general",
        "click",
        "strings",
        "roboto",
        "next",
        "usa windows",
        "finished",
        "queueprogress",
        "timestamp input",
        "threat level",
        "october",
        "september",
        "hwp support",
        "fresh",
        "win64",
        "khtml",
        "gecko",
        "brand",
        "microsoft edge",
        "programfiles",
        "comspec",
        "model",
        "iframe",
        "form",
        "listeners",
        "initial access",
        "t1590 gather",
        "victim network",
        "ssl certificate",
        "quasi government",
        "jeffrey reimer",
        "palantir",
        "Regis university",
        "otx hp",
        "apple",
        "pegasus",
        "h5 data center",
        "florence colorado",
        "brian sabey",
        "target : Tsara Brasheaers",
        "aig",
        "industry and commerce",
        "united states",
        "State of Colorado.",
        "date",
        "status",
        "domain",
        "hostname add",
        "pulse pulses",
        "files ip",
        "address",
        "url https",
        "url http",
        "hostname",
        "show",
        "type indicator",
        "source hostname",
        "entries",
        "Prometheus Intelligence Technology",
        "pulse submit",
        "america flag",
        "body",
        "dynamicloader",
        "microsoft azure",
        "tls issuing",
        "named pipe",
        "json",
        "ascii text",
        "lredmond",
        "Apple",
        "Telnet",
        "BusyBox",
        "Pegasus",
        "Colorado State Fixer: Christopher P. Ahmann",
        "Hijacker: Brian Sabey",
        "For: Concentra",
        "Protecting Assaulter: Jeffrey Reimer",
        "For: AIG",
        "For Industry and Commerce",
        "For: Quasi Government",
        "For: Workers Compensation",
        "Authorities",
        "Law Enforcement Dark",
        "Silencing",
        "Tampering with a Victim",
        "Meta",
        "Palantir",
        "Google",
        "Bing",
        "Microsoft",
        "ColoCrossing",
        "Associates",
        "hit men"
      ],
      "references": [
        "ET Telnet |  https://www.colocrossing.com | velocity servers",
        "https://www.endgamesystems.com/\t This is not a game. This is about people\u2019s lives",
        "TELNET SUSPICIOUS Path to BusyBox\", TELNET login failed\", is__elf \u007fELF dead_host",
        "Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually)",
        "(legitimate services will remain up-and-running usually) High |  ID dead_host",
        "ELF:Mirai-GH\\ [Trj] ,  Unix.Trojan.DarkNexus-7679166-0",
        "IDS Detections SUSPICIOUS Path to BusyBox TELNET login failed Bad Login",
        "Yara Detections is__elf",
        "Alerts dead_host network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "Yara Detections is__elf ,  ELFHighEntropy ,  elf_empty_sections",
        "http://appleid.apple.com.msg206.site/   http://www.icloud.com.msg206.site/   https://appleid.apple.com.msg206.site/",
        "https://colocrossing.com/ \u2022 https://www.colocrossing.com/colocation\t l",
        "https://prometheussteakhouse.lupi.delivery/ Thanks! I\u2019m heavy into Picinha. 2 Brazilian roasts please!",
        "https://www.colocrossing.com/",
        "(TLI did you do her that dirty?) Why\u2019SCS\u2019? Pure shame on you.",
        "In all seriousness. The severity of  injuries and outcomes 1 victim had is aligned cyber attacks by Q.Gov",
        "104.21.51.140, 172.67.181.41",
        "Detections Win.Packed.ImminentMonitorRAT-9892275-0 ,  HackTool:MSIL/Boilod.C!bit",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Alerts: procmem_yara injection_inter_process ransomware_file_modifications stack_pivot",
        "stealth_file cape_detected_threat injection_process_hollowing antiav_detectfile  injection_runpe",
        "Alerts: cape_extracted_content infostealer_cookies recon_fingerprint powershell_download",
        "Alerts: dynamic_function_loading ipc_namedpipe  createtoolhelp32snapshot_module_enumeration",
        "IP\u2019s Contacted: 142.250.147.101  88.221.104.56  13.33.141.29  35.186.249.72  151.101.1.192",
        "IP\u2019s Contacted 178.249.97.99  178.249.97.98  178.249.97.23  84.53.172.74  88.221.104.82",
        "Domains Contacted: accounts.google.com chrome.cloudflare-dns.com clients2.googleusercontent.com",
        "This is hard to comprehend or put into indelible words."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Unix.Trojan.DarkNexus-7679166-0",
          "display_name": "Unix.Trojan.DarkNexus-7679166-0",
          "target": null
        },
        {
          "id": "HackTool:MSIL/Boilod.C!bit",
          "display_name": "HackTool:MSIL/Boilod.C!bit",
          "target": "/malware/HackTool:MSIL/Boilod.C!bit"
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1098",
          "name": "Account Manipulation",
          "display_name": "T1098 - Account Manipulation"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1462",
          "name": "Malicious Software Development Tools",
          "display_name": "T1462 - Malicious Software Development Tools"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [
        "Technology",
        "Healthcare",
        "Insurance",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6390,
        "domain": 723,
        "hostname": 1978,
        "FileHash-SHA256": 1912,
        "FileHash-MD5": 410,
        "FileHash-SHA1": 306,
        "email": 3,
        "SSLCertFingerprint": 28,
        "CVE": 3
      },
      "indicator_count": 11753,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "76 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6935c92c5fc93fd873c6aa6d",
      "name": "[COINBASECARTEL] - Ransomware Victim: Cinvestav - RedPacket Security | CVE-2025-11727 (New)",
      "description": "Related to multiple exploits. Government Cyber Defense implications but shows as very legitimate looking masquerading. I am not positive and don\u2019t want to move to Belfast. Populated NSA [.] gov domains and subdomains (w/o no headers) lightly researched but does not assert a government identity. \n*New CVE-2025-11727",
      "modified": "2026-01-06T18:04:02.620000",
      "created": "2025-12-07T18:36:28.055000",
      "tags": [
        "memcommit",
        "read c",
        "t1082",
        "cryptexportkey",
        "invalid pointer",
        "write",
        "msil",
        "malware",
        "media",
        "autorun",
        "countries",
        "united",
        "america",
        "high defense",
        "evasion",
        "t1055",
        "ck technique",
        "technique id",
        "allocates",
        "potential code",
        "attempts",
        "threatintel",
        "dark web",
        "coinbasecartel",
        "ransomware",
        "osint",
        "tor",
        "data breach",
        "cinvestav",
        "ai generated",
        "ransomware leak",
        "page",
        "november",
        "investigacin y",
        "nacional",
        "mexican",
        "mexico",
        "present nov",
        "verdana",
        "td tr",
        "passive dns",
        "ip address",
        "urls",
        "aaaa",
        "present may",
        "present oct",
        "present jul",
        "virtool",
        "present sep",
        "present jun",
        "win32",
        "default",
        "unicode",
        "png image",
        "rgba",
        "high",
        "dock",
        "execution",
        "xport",
        "unknown",
        "data upload",
        "extraction",
        "will",
        "data",
        "name cloudflare",
        "hostmaster name",
        "org cloudflare",
        "townsend st",
        "city san",
        "us creation",
        "kelihos",
        "ipv4",
        "present dec",
        "files",
        "domain",
        "search",
        "hostname",
        "verdict",
        "location united",
        "asn as16625",
        "akamai",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results nov",
        "present aug",
        "backdoor",
        "msie",
        "chrome",
        "trojan",
        "mtb aug",
        "worm",
        "cryp",
        "junkpoly",
        "twitter",
        "trojandropper",
        "title",
        "germany unknown",
        "ipv4 add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "cologne",
        "search engine",
        "gse compromised",
        "redacted for",
        "privacy admin",
        "privacy tech",
        "server",
        "organization",
        "street",
        "city",
        "stateprovince",
        "postal code",
        "country",
        "resolver domain",
        "cape sa",
        "virustot",
        "type pdf",
        "name",
        "lookups",
        "email abuse",
        "historical ssl",
        "certificates",
        "first",
        "graph summary",
        "cname",
        "address",
        "ip2location",
        "bogon ip",
        "admin",
        "network",
        "wifi password",
        "ssid",
        "demo",
        "details",
        "failed",
        "include review",
        "exclude sugges",
        "onlv",
        "x try",
        "find s",
        "typ url",
        "url data",
        "severity att",
        "module load",
        "icmp traffic",
        "dns query",
        "t1055 jseval",
        "windows nt",
        "port",
        "entries",
        "destination",
        "medium",
        "show",
        "pecompact",
        "june",
        "service",
        "next",
        "xserver",
        "encrypt",
        "t1129",
        "windows module",
        "dlls",
        "convention",
        "windows native"
      ],
      "references": [
        "Search Engines \u2022 Browser Extensions | Google.com.? | Duck DNS",
        "Related : Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
        "hallplan.vm05.iveins.de",
        "https://otx.alienvault.com/pulse/65b85faa9b8e3e1206d7f25c",
        "Masquerading as?  : bitcoin-king.nsa.mx  \u2022 cpcontacts.nsa.mx  \u2022 vulkanslot-bet777.nsa.mx",
        "Name : iveins.de  Service : connect",
        "https://www.redpacketsecurity.com/coinbasecartel-ransomware-victim-cinvestav \u2022 evilginx.redpacketsecurity.com",
        "phish-demo-poc.phish-demo-poc.redpacketsecurity.com \u2022 phish-demo-poc.redpacketsecurity.com",
        "https://otx.alienvault.com/indicator/cve/CVE-2025-11727"
      ],
      "public": 1,
      "adversary": "COINBASECARTEL",
      "targeted_countries": [
        "United States of America",
        "Sweden",
        "Bangladesh",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Tiggre!rfn",
          "display_name": "Trojan:Win32/Tiggre!rfn",
          "target": "/malware/Trojan:Win32/Tiggre!rfn"
        },
        {
          "id": "MSIL:Agent-DQ\\ [Trj]",
          "display_name": "MSIL:Agent-DQ\\ [Trj]",
          "target": null
        },
        {
          "id": "VirTool:MSIL/Covent.A",
          "display_name": "VirTool:MSIL/Covent.A",
          "target": "/malware/VirTool:MSIL/Covent.A"
        },
        {
          "id": "Trojan:Win32/Pynamer!rfn",
          "display_name": "Trojan:Win32/Pynamer!rfn",
          "target": "/malware/Trojan:Win32/Pynamer!rfn"
        },
        {
          "id": "Win64:TrojanX",
          "display_name": "Win64:TrojanX",
          "target": null
        },
        {
          "id": "VirTool:MSIL/Covent",
          "display_name": "VirTool:MSIL/Covent",
          "target": "/malware/VirTool:MSIL/Covent"
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
          "display_name": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
          "target": null
        },
        {
          "id": "Win32:Malware",
          "display_name": "Win32:Malware",
          "target": null
        },
        {
          "id": "Kelihos",
          "display_name": "Kelihos",
          "target": null
        },
        {
          "id": "CVE-2025-11727",
          "display_name": "CVE-2025-11727",
          "target": null
        },
        {
          "id": "Exploit:JS/CVE-2014-0322",
          "display_name": "Exploit:JS/CVE-2014-0322",
          "target": "/malware/Exploit:JS/CVE-2014-0322"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1098",
          "name": "Account Manipulation",
          "display_name": "T1098 - Account Manipulation"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        }
      ],
      "industries": [
        "Education"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 117,
        "FileHash-SHA256": 1746,
        "URL": 5018,
        "hostname": 1827,
        "domain": 1072,
        "CVE": 3,
        "email": 2,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 9938,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "102 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6919473b9e0624394e9b68e9",
      "name": "Backdoor:Linux/DemonBot Affecting Unsecured servers",
      "description": "A closer look at a hacker group found in  Mirai Bot Network. Catgirls is still active , has running web server , is  only viewable to group according to remarks regarding \u2018catgirls\u2019 domains , sub domains , hosts.\n\n Multiple hosts , name servers and links. .Backdoor:Linux/DemonBot Malicious attacks affecting unsecured servers  (personal , business) networks, DDOS attacks , Mitre. Worm, Ransomware. \n\nHacker group has seemingly caused a fair ammunition of damage to small businesses and / or individuals/civil society.. Seen in attacks against handful of targets are in this Mirai Botnet. Of course we know how very large the  Mirai Botnet is.",
      "modified": "2025-12-16T03:02:09.743000",
      "created": "2025-11-16T03:38:35.430000",
      "tags": [
        "server",
        "algorithm",
        "x509v3 subject",
        "registrar abuse",
        "v3 serial",
        "spaceship",
        "community",
        "related pulses",
        "cidr",
        "mirai botnet",
        "hacker",
        "mirai att",
        "ck id",
        "group",
        "active",
        "generic pong",
        "reporting arch",
        "msie",
        "windows nt",
        "resolverror",
        "backdoor",
        "malware",
        "strings",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "evasion att",
        "t1480 execution",
        "ipv4",
        "iocs",
        "drop",
        "review iocs",
        "found",
        "ascii text",
        "pattern match",
        "mitre att",
        "beginstring",
        "null",
        "refresh",
        "span",
        "hybrid",
        "click",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "united",
        "moved",
        "passive dns",
        "urls",
        "record value",
        "unknown aaaa",
        "gmt content",
        "title",
        "cookie",
        "signing defense",
        "t1553 technique",
        "subvert trust",
        "controls learn",
        "disable",
        "modify tools",
        "defense evasion",
        "t1562 technique",
        "rdap",
        "domain database",
        "dap domain",
        "datab",
        "database",
        "array",
        "content",
        "ascii",
        "form",
        "initial access",
        "execution",
        "present aug",
        "present jul",
        "present nov",
        "present oct",
        "ip address",
        "command decode",
        "suricata ipv4",
        "localappdata",
        "windir",
        "openurl c",
        "programfiles",
        "edge",
        "cloudflare",
        "ssl certificate",
        "size",
        "starfield",
        "accept",
        "path",
        "general",
        "local",
        "hostname add",
        "pulse pulses",
        "read c",
        "port",
        "destination",
        "rgba",
        "unicode text",
        "medium",
        "unknown",
        "code",
        "write",
        "pecompact",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "crash",
        "next",
        "china unknown",
        "chrome",
        "internal server",
        "next associated",
        "ipv4 add",
        "trojandropper",
        "date",
        "domain",
        "search",
        "domain add",
        "certificate",
        "next http",
        "scans show",
        "found title",
        "head body",
        "hostname",
        "files",
        "files ip",
        "address",
        "location united",
        "asn asnone",
        "present feb",
        "present jun",
        "unknown ns",
        "internet",
        "emails",
        "present sep",
        "show",
        "memcommit",
        "gapd5d",
        "key0",
        "packing t1045",
        "filehash",
        "sha1 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "medium risk",
        "mirai",
        "json",
        "total",
        "delete",
        "win64",
        "url http",
        "http",
        "related nids",
        "files location",
        "flag united",
        "gmt cache",
        "pulse submit",
        "url analysis",
        "verdict",
        "win32dh",
        "reverse dns",
        "america flag",
        "worm",
        "warehouse mgmt",
        "built",
        "retailexperts",
        "read",
        "top source",
        "top destination",
        "aaaa",
        "ransom",
        "trojan",
        "entries",
        "singapore",
        "singapore asn",
        "as16509",
        "present mar",
        "creation date",
        "contacted",
        "hostile",
        "targeting",
        "whitelisted",
        "high",
        "systemroot",
        "as15169",
        "copy",
        "global",
        "dynamicloader",
        "directui",
        "yara rule",
        "element",
        "classinfobase",
        "ccbase",
        "hwndhost",
        "windows"
      ],
      "references": [
        "http://catgirls.foundation/main \u2022 https://spaceship.com/",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2"
      ],
      "public": 1,
      "adversary": "Mirai",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Linux/DemonBot.Aa!MTB",
          "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
          "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
        },
        {
          "id": "Mirai (ELF)",
          "display_name": "Mirai (ELF)",
          "target": null
        },
        {
          "id": "Backdoor:Linux/Mirai",
          "display_name": "Backdoor:Linux/Mirai",
          "target": "/malware/Backdoor:Linux/Mirai"
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "PSW.Sinowal.X",
          "display_name": "PSW.Sinowal.X",
          "target": null
        },
        {
          "id": "mirai",
          "display_name": "mirai",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Win.Virus.PolyRansom-5704625-0",
          "display_name": "Win.Virus.PolyRansom-5704625-0",
          "target": null
        },
        {
          "id": "Worm:Win32/Locksky.gen!A",
          "display_name": "Worm:Win32/Locksky.gen!A",
          "target": "/malware/Worm:Win32/Locksky.gen!A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1991,
        "domain": 428,
        "hostname": 882,
        "FileHash-SHA256": 2213,
        "FileHash-MD5": 675,
        "FileHash-SHA1": 530,
        "email": 7,
        "CIDR": 1,
        "CVE": 1,
        "SSLCertFingerprint": 23
      },
      "indicator_count": 6751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "124 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6893eee9bf1b30e08d1a6d8e",
      "name": "Ransom:Win32/CVE - Denver \u2022 Community Lifestyle Neighborhood",
      "description": "*Ransom:Win32/CVE - * Win.Dropper.Stone-9856966-0,\nDenver \u2022 Community Lifestyle Neighborhood. \nCorporate & Leasing Office corrupted with spyware. There is a single verified monitored target. All technology devices corrupted, at least 2 phones monitored, YouTube is courtesy of hackers. Several in person and phone investigations, staff change and they know nothing about leasing apartments, townhomes , etiquette, poor communication. Target also investigated. It appears to be harassment, intimidation and monitoring for unspecified reasons. The parking lot is stacked with obvious people sitting in their vehicles for hours. It\u2019s unclear if the staffing change is legitimate or part of an investigation.",
      "modified": "2025-09-05T23:02:52.811000",
      "created": "2025-08-07T00:10:17.696000",
      "tags": [
        "address google",
        "safe browsing",
        "united",
        "typeof",
        "passive dns",
        "body doctype",
        "nreum",
        "date",
        "gmt server",
        "apache x",
        "cnection",
        "content type",
        "span",
        "ok transfer",
        "encoding",
        "x powered",
        "unknown soa",
        "unknown ns",
        "showing",
        "entries",
        "next associated",
        "urls show",
        "body",
        "encrypt",
        "search",
        "ip address",
        "creation date",
        "record value",
        "present jul",
        "present may",
        "present apr",
        "certificate",
        "present aug",
        "present feb",
        "present dec",
        "present nov",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "ascii text",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "itre att",
        "accept",
        "sha256",
        "size",
        "type data",
        "utf8 text",
        "document file",
        "flag",
        "server",
        "european union",
        "name server",
        "tor analysis",
        "dns requests",
        "domain address",
        "ii llc",
        "windir",
        "openurl c",
        "prefetch2",
        "show process",
        "ogoogle trust",
        "network traffic",
        "organization",
        "elton avundano",
        "object",
        "title object",
        "header http2",
        "returnurl",
        "texas",
        "rsa ov",
        "ssl ca",
        "status",
        "australia",
        "netherlands",
        "urls",
        "gmt path",
        "hostname add",
        "pulse submit",
        "present oct",
        "e safe",
        "results jul",
        "response ip",
        "present jan",
        "name servers",
        "verdict",
        "domain",
        "files ip",
        "address domain",
        "xhr start",
        "xhr load",
        "aaaa",
        "read c",
        "show",
        "port",
        "destination",
        "high",
        "delete",
        "outbound m3",
        "copy",
        "write",
        "persistence",
        "execution",
        "malware",
        "generic",
        "unknown",
        "present mar",
        "dynamicloader",
        "wine emulator",
        "dynamic",
        "medium",
        "read",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "dnssec",
        "domain name",
        "solutions",
        "llc status",
        "next passive",
        "dns status",
        "hostname query",
        "files show",
        "date hash",
        "avast avg",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "virtool",
        "win64",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "file discovery",
        "utf8",
        "crlf line",
        "a domains",
        "script urls",
        "link",
        "unknown aaaa",
        "meta",
        "atom",
        "results jan",
        "present",
        "present sep",
        "akamai",
        "asn as16625",
        "less whois",
        "registrar",
        "http",
        "france flag",
        "france hostname",
        "files related",
        "url analysis",
        "files",
        "location france",
        "detailed error",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "name",
        "perfect privacy",
        "error jul",
        "next related",
        "domains show",
        "domain related",
        "url add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "france asn",
        "as16276",
        "dns resolutions",
        "datacenter",
        "regopenkeyexa",
        "regsetvalueexa",
        "windows nt",
        "regdword",
        "hostile",
        "service",
        "delphi",
        "next",
        "pulses none",
        "related tags",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "review",
        "data upload",
        "extraction",
        "khtml",
        "gecko",
        "olet",
        "cnlet",
        "tlsv1",
        "hacktool",
        "push",
        "ms windows",
        "intel",
        "pe32",
        "users",
        "precreate read",
        "ransom",
        "code",
        "installer",
        "june",
        "media",
        "autorun",
        "next yara",
        "detections name",
        "aspackv2xxx",
        "eu alexey",
        "alerts",
        "pe file",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "yara detections",
        "analysis date",
        "april",
        "packing t1045",
        "t1045",
        "t1060",
        "registry run",
        "keys",
        "user execution",
        "icmp traffic"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1132,
        "URL": 6245,
        "hostname": 2264,
        "FileHash-SHA256": 1857,
        "FileHash-SHA1": 491,
        "email": 9,
        "FileHash-MD5": 573,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 12587,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6891980740656e8b21b31d0a",
      "name": "Tracker | Mirai | Virtool | Tofsee | Phishing +",
      "description": "Tracker found in \u2018alleged \u2018 Jefferson County, Co website also a single link was found in a collection of phishing websites by a OTX researcher in 2023. \nI can\u2019t comment much. \n#overreach\n#https://reviewable.io/reviews/palantir/godel-conjure-plugin/549",
      "modified": "2025-09-04T05:03:13.563000",
      "created": "2025-08-05T05:35:03.786000",
      "tags": [
        "url https",
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "date",
        "for privacy",
        "redacted for",
        "status",
        "hostname add",
        "pulse submit",
        "url analysis",
        "files",
        "united",
        "entries",
        "search",
        "unknown aaaa",
        "overview ip",
        "address",
        "location united",
        "asn as35916",
        "whois registrar",
        "showing",
        "next associated",
        "meta http",
        "content",
        "index",
        "th th",
        "443 ma2592000",
        "body",
        "ip address",
        "asn as54113",
        "name servers",
        "expiration date",
        "resources whois",
        "urlvoid",
        "related",
        "comments",
        "whois show",
        "present jun",
        "script urls",
        "enom",
        "record value",
        "certificate",
        "formbook cnc",
        "checkin",
        "neue",
        "ipv4",
        "exploit",
        "trojan",
        "virtool",
        "ransom",
        "win32",
        "ipv4 add",
        "unknown cname",
        "unknown ns",
        "script domains",
        "meta",
        "config",
        "associated urls",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next http",
        "present may",
        "present oct",
        "present jul",
        "aaaa",
        "present sep",
        "domain",
        "creation date",
        "expiration",
        "url http",
        "present dec",
        "present jan",
        "reverse dns",
        "present mar",
        "present nov",
        "a domains",
        "verdict",
        "files ip",
        "next related",
        "domains show",
        "domain related",
        "cryp",
        "date hash",
        "avast avg",
        "entries related",
        "mtb may",
        "trojandropper",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "files show",
        "none google",
        "safe browsing",
        "death",
        "indicator facts",
        "historical otx",
        "twitter running",
        "open ports",
        "memcommit",
        "medium",
        "read c",
        "post http",
        "delete",
        "windows nt",
        "malware",
        "copy",
        "write",
        "msie",
        "chrome",
        "backdoor",
        "junkpoly",
        "worm"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4488,
        "hostname": 1442,
        "domain": 746,
        "email": 6,
        "FileHash-SHA256": 1122,
        "FileHash-MD5": 345,
        "FileHash-SHA1": 337,
        "CVE": 2
      },
      "indicator_count": 8488,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://vpn-jp.keke125.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://vpn-jp.keke125.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776599157.2407281
}