{
  "type": "URL",
  "indicator": "https://w.pocolegion.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://w.pocolegion.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2910332165,
      "indicator": "https://w.pocolegion.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 18,
      "pulses": [
        {
          "id": "68e2b9fd811ffc6684ba25f7",
          "name": "Isolated DoD now DoW nodes - emotional commentary",
          "description": "*https://www.sentient.industries/\n*trk.b.jackrogersusa.com\n*http://trk.southerntide.com/\nOTX is auto populating this pulse. Let\u2019s see\u2026",
          "modified": "2025-11-04T18:01:18.650000",
          "created": "2025-10-05T18:33:33.277000",
          "tags": [
            "united",
            "present feb",
            "present may",
            "aaaa",
            "present jul",
            "passive dns",
            "ip address",
            "present dec",
            "present sep",
            "present jun",
            "url https",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "germany",
            "taiwan",
            "netherlands",
            "china",
            "search",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "ascii text",
            "size",
            "pattern match",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "body",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "title",
            "look",
            "verify",
            "restart",
            "filehashmd5",
            "hostname",
            "filehashsha256",
            "types of",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "ruby",
            "jeffrey reimer",
            "target",
            "tsara",
            "information",
            "capture",
            "gather victim",
            "report spam",
            "kill targets",
            "created",
            "starfield",
            "show technique",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1333,
            "domain": 355,
            "URL": 5874,
            "hostname": 1066,
            "FileHash-SHA1": 101,
            "FileHash-MD5": 88,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 8819,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "166 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65944b9812ea52ab41c0259d",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2024-01-02T17:44:56.709000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659127f3265ec6306b607faa",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-31T08:36:03.380000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658f967a4fc7ebe8021b9382",
          "name": "Mirai Apple Attack +",
          "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-30T04:03:06.598000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570913ea199e27fa3fc3266",
          "name": "btloader.com part 2 that otx froze - CVE-2017-0147 -",
          "description": "",
          "modified": "2023-12-06T15:20:29.831000",
          "created": "2023-12-06T15:20:29.831000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "hostname": 325,
            "domain": 122,
            "FileHash-SHA256": 393,
            "URL": 1000
          },
          "indicator_count": 1841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708b4fe416f6d10793d0d0",
          "name": "malware",
          "description": "",
          "modified": "2023-12-06T14:55:11.659000",
          "created": "2023-12-06T14:55:11.659000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1778,
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "hostname": 3563,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 18
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 112,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708b44eddb0e778213b050",
          "name": "malware",
          "description": "",
          "modified": "2023-12-06T14:55:00.045000",
          "created": "2023-12-06T14:55:00.045000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1778,
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "hostname": 3563,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 18
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708b383c8b03479a9c500f",
          "name": "malware",
          "description": "",
          "modified": "2023-12-06T14:54:48.631000",
          "created": "2023-12-06T14:54:48.631000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1778,
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "hostname": 3563,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 18
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708b2e1289df77178ac02a",
          "name": "malware",
          "description": "",
          "modified": "2023-12-06T14:54:38.099000",
          "created": "2023-12-06T14:54:38.099000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1778,
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "hostname": 3563,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 18
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708b21e8b64037edbd6a89",
          "name": "malware",
          "description": "",
          "modified": "2023-12-06T14:54:25.584000",
          "created": "2023-12-06T14:54:25.584000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1778,
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "hostname": 3563,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "CIDR": 1,
            "SSLCertFingerprint": 18
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708acfbf9280d126a8e668",
          "name": "McKesson.com ~ 04.06.2022",
          "description": "",
          "modified": "2023-12-06T14:53:03.195000",
          "created": "2023-12-06T14:53:03.195000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1751,
            "hostname": 2775,
            "URL": 9984,
            "domain": 665,
            "email": 3,
            "FileHash-SHA1": 2,
            "FileHash-MD5": 4
          },
          "indicator_count": 15184,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62f2d5b46351f77f312db0fd",
          "name": "btloader.com part 2 that otx froze - CVE-2017-0147 -",
          "description": "",
          "modified": "2022-09-08T00:01:12.540000",
          "created": "2022-08-09T21:46:28.473000",
          "tags": [
            "ipv4",
            "url http",
            "cdn range",
            "positive ipv4",
            "akamai rank",
            "type indicator",
            "reason hostname",
            "private ip",
            "address url",
            "CVE-2017-0147"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1000,
            "hostname": 325,
            "FileHash-SHA256": 393,
            "domain": 122,
            "CVE": 1
          },
          "indicator_count": 1841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 401,
          "modified_text": "1319 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624d8d844d2bc304c780d158",
          "name": "McKesson.com ~ 04.06.2022",
          "description": "",
          "modified": "2022-08-20T16:20:43.684000",
          "created": "2022-04-06T12:54:28.513000",
          "tags": [
            "registrar csc",
            "date",
            "sophos health",
            "comodo valkyrie",
            "verdict mobile",
            "businesseconomy",
            "ranks rank",
            "value ingestion",
            "time majestic",
            "utc statvoo",
            "umbrella",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "atlas r3",
            "dv tls",
            "q1 oglobalsign",
            "server",
            "domain status",
            "code",
            "registrar abuse",
            "rancho cordova",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "community",
            "links https",
            "httponly",
            "submission",
            "samesitelax",
            "navlanguage1033",
            "sitecurrency840",
            "conttype",
            "userculture1033",
            "health comodo",
            "Ransomware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "W32/Scribble-B",
              "display_name": "W32/Scribble-B",
              "target": null
            },
            {
              "id": "Win32/Virut.E",
              "display_name": "Win32/Virut.E",
              "target": null
            },
            {
              "id": "Trojan.Dropper.UXZ",
              "display_name": "Trojan.Dropper.UXZ",
              "target": null
            },
            {
              "id": "Win32/Virut.NBP",
              "display_name": "Win32/Virut.NBP",
              "target": null
            },
            {
              "id": "Win32:Vitro",
              "display_name": "Win32:Vitro",
              "target": null
            },
            {
              "id": "W32/Virut.n.gen",
              "display_name": "W32/Virut.n.gen",
              "target": null
            },
            {
              "id": "Backdoor.Win32.Pushdo.rns",
              "display_name": "Backdoor.Win32.Pushdo.rns",
              "target": null
            },
            {
              "id": "PE_VIRUX.Q-1",
              "display_name": "PE_VIRUX.Q-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1139129",
              "display_name": "Win.Trojan.Agent-1139129",
              "target": null
            },
            {
              "id": "W32.Virut.CF",
              "display_name": "W32.Virut.CF",
              "target": null
            },
            {
              "id": "Virus:Win32/Virut.EPO",
              "display_name": "Virus:Win32/Virut.EPO",
              "target": "/malware/Virus:Win32/Virut.EPO"
            },
            {
              "id": "Ransom:Win64/Gojdu.A",
              "display_name": "Ransom:Win64/Gojdu.A",
              "target": "/malware/Ransom:Win64/Gojdu.A"
            }
          ],
          "attack_ids": [],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9984,
            "hostname": 2775,
            "domain": 665,
            "FileHash-SHA256": 1751,
            "email": 3,
            "FileHash-SHA1": 2,
            "FileHash-MD5": 4
          },
          "indicator_count": 15184,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 411,
          "modified_text": "1338 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624fd927e52d5ef693a5cd77",
          "name": "malware",
          "description": "",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T06:41:43.877000",
          "tags": [
            "filehashsha256",
            "ipv4",
            "quaqv1",
            "prvideo",
            "ptsnmapp",
            "bdunknown",
            "dvs898tp",
            "mdlenovoa360t",
            "mflenovo",
            "zoneid",
            "core",
            "explorer",
            "service",
            "demo",
            "model"
          ],
          "references": [
            "624d8d844d2bc304c780d158.csv"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tthanhtung643@gmail.com",
            "id": "187831",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "FileHash-SHA256": 1778,
            "CIDR": 1,
            "SSLCertFingerprint": 18,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "hostname": 3563
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 43,
          "modified_text": "1442 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624fd927bbc761bd6c6a426d",
          "name": "malware",
          "description": "",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T06:41:43.346000",
          "tags": [
            "filehashsha256",
            "ipv4",
            "quaqv1",
            "prvideo",
            "ptsnmapp",
            "bdunknown",
            "dvs898tp",
            "mdlenovoa360t",
            "mflenovo",
            "zoneid",
            "core",
            "explorer",
            "service",
            "demo",
            "model"
          ],
          "references": [
            "624d8d844d2bc304c780d158.csv"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tthanhtung643@gmail.com",
            "id": "187831",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "FileHash-SHA256": 1778,
            "CIDR": 1,
            "SSLCertFingerprint": 18,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "hostname": 3563
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "1442 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624fd9250470ff789e1b6142",
          "name": "malware",
          "description": "",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T06:41:41.637000",
          "tags": [
            "filehashsha256",
            "ipv4",
            "quaqv1",
            "prvideo",
            "ptsnmapp",
            "bdunknown",
            "dvs898tp",
            "mdlenovoa360t",
            "mflenovo",
            "zoneid",
            "core",
            "explorer",
            "service",
            "demo",
            "model"
          ],
          "references": [
            "624d8d844d2bc304c780d158.csv"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tthanhtung643@gmail.com",
            "id": "187831",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "FileHash-SHA256": 1778,
            "CIDR": 1,
            "SSLCertFingerprint": 18,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "hostname": 3563
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "1442 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624fd91a4f52435d6ab3002a",
          "name": "malware",
          "description": "",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T06:41:30.292000",
          "tags": [
            "filehashsha256",
            "ipv4",
            "quaqv1",
            "prvideo",
            "ptsnmapp",
            "bdunknown",
            "dvs898tp",
            "mdlenovoa360t",
            "mflenovo",
            "zoneid",
            "core",
            "explorer",
            "service",
            "demo",
            "model"
          ],
          "references": [
            "624d8d844d2bc304c780d158.csv"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tthanhtung643@gmail.com",
            "id": "187831",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "FileHash-SHA256": 1778,
            "CIDR": 1,
            "SSLCertFingerprint": 18,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "hostname": 3563
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 41,
          "modified_text": "1442 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624fd91848164eef74985f1a",
          "name": "malware",
          "description": "",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T06:41:28.719000",
          "tags": [
            "filehashsha256",
            "ipv4",
            "quaqv1",
            "prvideo",
            "ptsnmapp",
            "bdunknown",
            "dvs898tp",
            "mdlenovoa360t",
            "mflenovo",
            "zoneid",
            "core",
            "explorer",
            "service",
            "demo",
            "model"
          ],
          "references": [
            "624d8d844d2bc304c780d158.csv"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tthanhtung643@gmail.com",
            "id": "187831",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 781,
            "FileHash-SHA1": 499,
            "FileHash-SHA256": 1778,
            "CIDR": 1,
            "SSLCertFingerprint": 18,
            "URL": 9459,
            "domain": 692,
            "email": 9,
            "hostname": 3563
          },
          "indicator_count": 16800,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 42,
          "modified_text": "1442 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "103.246.145.111 phishing",
        "https://twitter.com/PORNO_SEXYBABES",
        "103.246.145.111  - scanning host",
        "nr-data.net | Apple Private Data collection",
        "00000000.apple.com  | remote SIM Swap",
        "624d8d844d2bc304c780d158.csv",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan.dropper.uxz",
            "Trojan.mirai/genericrxui",
            "Win32/virut.e",
            "W32/virut.n.gen",
            "Pe_virux.q-1",
            "Win.trojan.agent-1139129",
            "Backdoor.win32.pushdo.rns",
            "Win32/virut.nbp",
            "W32.virut.cf",
            "Win32:vitro",
            "Virus:win32/virut.epo",
            "Ransom:win64/gojdu.a",
            "Ratel",
            "W32/scribble-b"
          ],
          "industries": [
            "Healthcare"
          ],
          "unique_indicators": 46350
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/pocolegion.com",
    "whois": "http://whois.domaintools.com/pocolegion.com",
    "domain": "pocolegion.com",
    "hostname": "w.pocolegion.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 18,
  "pulses": [
    {
      "id": "68e2b9fd811ffc6684ba25f7",
      "name": "Isolated DoD now DoW nodes - emotional commentary",
      "description": "*https://www.sentient.industries/\n*trk.b.jackrogersusa.com\n*http://trk.southerntide.com/\nOTX is auto populating this pulse. Let\u2019s see\u2026",
      "modified": "2025-11-04T18:01:18.650000",
      "created": "2025-10-05T18:33:33.277000",
      "tags": [
        "united",
        "present feb",
        "present may",
        "aaaa",
        "present jul",
        "passive dns",
        "ip address",
        "present dec",
        "present sep",
        "present jun",
        "url https",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "germany",
        "taiwan",
        "netherlands",
        "china",
        "search",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "ascii text",
        "size",
        "pattern match",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "body",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "title",
        "look",
        "verify",
        "restart",
        "filehashmd5",
        "hostname",
        "filehashsha256",
        "types of",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "ruby",
        "jeffrey reimer",
        "target",
        "tsara",
        "information",
        "capture",
        "gather victim",
        "report spam",
        "kill targets",
        "created",
        "starfield",
        "show technique",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1333,
        "domain": 355,
        "URL": 5874,
        "hostname": 1066,
        "FileHash-SHA1": 101,
        "FileHash-MD5": 88,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 8819,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "166 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65944b9812ea52ab41c0259d",
      "name": "Mirai Apple Attack +",
      "description": "",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2024-01-02T17:44:56.709000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658f967a4fc7ebe8021b9382",
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659127f3265ec6306b607faa",
      "name": "Mirai Apple Attack +",
      "description": "",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2023-12-31T08:36:03.380000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658f967a4fc7ebe8021b9382",
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658f967a4fc7ebe8021b9382",
      "name": "Mirai Apple Attack +",
      "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2023-12-30T04:03:06.598000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570913ea199e27fa3fc3266",
      "name": "btloader.com part 2 that otx froze - CVE-2017-0147 -",
      "description": "",
      "modified": "2023-12-06T15:20:29.831000",
      "created": "2023-12-06T15:20:29.831000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "hostname": 325,
        "domain": 122,
        "FileHash-SHA256": 393,
        "URL": 1000
      },
      "indicator_count": 1841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708b4fe416f6d10793d0d0",
      "name": "malware",
      "description": "",
      "modified": "2023-12-06T14:55:11.659000",
      "created": "2023-12-06T14:55:11.659000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1778,
        "FileHash-MD5": 781,
        "FileHash-SHA1": 499,
        "hostname": 3563,
        "URL": 9459,
        "domain": 692,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 18
      },
      "indicator_count": 16800,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 112,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708b44eddb0e778213b050",
      "name": "malware",
      "description": "",
      "modified": "2023-12-06T14:55:00.045000",
      "created": "2023-12-06T14:55:00.045000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1778,
        "FileHash-MD5": 781,
        "FileHash-SHA1": 499,
        "hostname": 3563,
        "URL": 9459,
        "domain": 692,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 18
      },
      "indicator_count": 16800,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708b383c8b03479a9c500f",
      "name": "malware",
      "description": "",
      "modified": "2023-12-06T14:54:48.631000",
      "created": "2023-12-06T14:54:48.631000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1778,
        "FileHash-MD5": 781,
        "FileHash-SHA1": 499,
        "hostname": 3563,
        "URL": 9459,
        "domain": 692,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 18
      },
      "indicator_count": 16800,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708b2e1289df77178ac02a",
      "name": "malware",
      "description": "",
      "modified": "2023-12-06T14:54:38.099000",
      "created": "2023-12-06T14:54:38.099000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1778,
        "FileHash-MD5": 781,
        "FileHash-SHA1": 499,
        "hostname": 3563,
        "URL": 9459,
        "domain": 692,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 18
      },
      "indicator_count": 16800,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708b21e8b64037edbd6a89",
      "name": "malware",
      "description": "",
      "modified": "2023-12-06T14:54:25.584000",
      "created": "2023-12-06T14:54:25.584000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1778,
        "FileHash-MD5": 781,
        "FileHash-SHA1": 499,
        "hostname": 3563,
        "URL": 9459,
        "domain": 692,
        "email": 9,
        "CIDR": 1,
        "SSLCertFingerprint": 18
      },
      "indicator_count": 16800,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://w.pocolegion.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://w.pocolegion.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641695.768012
}