{
  "type": "URL",
  "indicator": "https://webflow.ad-maven.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://webflow.ad-maven.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4098394718,
      "indicator": "https://webflow.ad-maven.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "695035a98f01d94b2598f8ee",
          "name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University",
          "description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were  found. \n\nAll attacks immediately following assault.",
          "modified": "2026-01-26T18:04:20.395000",
          "created": "2025-12-27T19:38:17.198000",
          "tags": [
            "united",
            "unknown aaaa",
            "accept encoding",
            "moved",
            "urls",
            "files",
            "encrypt",
            "passive dns",
            "all ipv4",
            "america flag",
            "america asn",
            "ransom",
            "backdoor",
            "mtb win32",
            "mirai",
            "united states",
            "type indicator",
            "role title",
            "container",
            "ip address",
            "i div",
            "h2 p",
            "h4 p",
            "data",
            "desktop",
            "powerful",
            "url https",
            "url http",
            "indicator role",
            "active related",
            "cidr",
            "types",
            "indicators show",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "spawns",
            "mitre att",
            "ck matrix",
            "command decode",
            "programfiles",
            "suricata ipv4",
            "windir",
            "comspec",
            "hybrid",
            "general",
            "path",
            "model",
            "click",
            "strings",
            "prometheus",
            "palantir",
            "kill list",
            "tracking",
            "moon linksys",
            "router",
            "emotet",
            "active",
            "regis university",
            "ascii text",
            "show technique",
            "pattern match",
            "sha1",
            "show process",
            "root",
            "local",
            "development att",
            "ssl certificate",
            "extranet",
            "maven"
          ],
          "references": [
            "Palantir Extranet -https://prometheusintelligencetechnology.com/",
            "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
            "IDS Detections: TheMoon.linksys.router",
            "We don\u2019t know how Octoseek & ScoreBlie (Team8)  became part of \u2018No Problems\u2019",
            "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
            "This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
            "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
            "Tsara Brashears warned of hack, provided detailed information, provided advice",
            "\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
            "Find a way to safely begin from a new server. Work from a Virtual World Class",
            "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
            "Old staff slow, foolish but eventually heeded instructions / once it was too late",
            "Dean is deceased?  Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
            "She was in the botnet already",
            "Was denied after third enrollment showed false information",
            "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
            "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
            "Tsara was unable to finish her second degree this way. But found a way.",
            "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
            "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
            "Many pulses are missing. When we first began using this tool PIT was what we researched first",
            "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
            "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
            "She refused. Two weeks later  man is parked outside of her residence in a different county and city.",
            "I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
            "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
            "Lots of detail because someone , somewhere is going through this."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Win32:RansomX-gen\\ [Ransom]",
              "display_name": "Win32:RansomX-gen\\ [Ransom]",
              "target": null
            },
            {
              "id": "ELF:Mirai-AAL\\ [Trj]",
              "display_name": "ELF:Mirai-AAL\\ [Trj]",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1553.001",
              "name": "Gatekeeper Bypass",
              "display_name": "T1553.001 - Gatekeeper Bypass"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 5,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1037,
            "domain": 161,
            "hostname": 340,
            "email": 2,
            "FileHash-SHA256": 315,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 20,
            "CIDR": 16,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 1913,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "83 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695043197c2fbfda85abc1d4",
          "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
          "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
          "modified": "2025-12-27T20:35:37.012000",
          "created": "2025-12-27T20:35:37.012000",
          "tags": [
            "Palantir",
            "Ad- Maven",
            "Prometheus Intelligence Technology"
          ],
          "references": [
            "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
            "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Carts.Guru",
              "display_name": "Carts.Guru",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Education",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 82,
            "hostname": 180,
            "URL": 995,
            "FileHash-SHA256": 110
          },
          "indicator_count": 1367,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "113 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688716977e80a4274f2eafa9",
          "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
          "description": "Found in Bot joining Pulse.",
          "modified": "2025-08-27T06:03:05.020000",
          "created": "2025-07-28T06:20:07.660000",
          "tags": [
            "present jul",
            "united",
            "entries",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "body",
            "meta",
            "passive dns",
            "next associated",
            "win32spigot apr",
            "title error",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "files",
            "adaptivebee",
            "worm",
            "win32",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "location united",
            "asn asnone",
            "nameservers",
            "less whois",
            "registrar",
            "csc corporate",
            "status",
            "servers",
            "name servers",
            "hostname",
            "hostname add",
            "a domains",
            "script urls",
            "unknown aaaa",
            "technology one",
            "script script",
            "certificate",
            "null",
            "trojan",
            "twitter",
            "domain",
            "files ip",
            "address domain",
            "ip related",
            "pulses otx",
            "virtool",
            "http",
            "present jun",
            "present may",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "australia asn",
            "as55532 squiz",
            "dns resolutions",
            "overview ip",
            "address",
            "ipv4",
            "iocs",
            "data upload",
            "extraction",
            "ided iocs",
            "failed",
            "shaw",
            "ail tvnas",
            "rl irl",
            "domain add",
            "ostname add",
            "verdict",
            "show",
            "types",
            "type",
            "indicator data",
            "searc type",
            "a indicator",
            "data",
            "select across",
            "all pages",
            "domain domain",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "msie",
            "chrome",
            "present dec",
            "base",
            "read c",
            "port",
            "destination",
            "delete",
            "copy",
            "write",
            "memcommit",
            "cryptexportkey",
            "invalid pointer",
            "writeconsolea",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "ascii text",
            "crlf line",
            "mitre att",
            "error",
            "click",
            "hybrid",
            "local",
            "path",
            "starfield",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "form",
            "adversaries",
            "windows nt",
            "generic http",
            "exe upload",
            "inbound",
            "outbound",
            "yara detections",
            "malware",
            "expiration date",
            "whois show",
            "name andrew",
            "bauer name",
            "div id",
            "beginstring",
            "beginerror",
            "script",
            "general",
            "cloud",
            "find",
            "footer",
            "ninite feb",
            "telper",
            "ninite mar",
            "ninite apr",
            "trojandropper",
            "mtb mar",
            "url https",
            "general full",
            "security tls",
            "software",
            "resource hash",
            "protocol h2",
            "frankfurt",
            "main",
            "germany",
            "input",
            "skype",
            "opciones",
            "july",
            "es form",
            "dom name",
            "post https",
            "imagen",
            "microsoft",
            "iniciar sesin",
            "value",
            "variables",
            "config",
            "debug",
            "loader",
            "geturl",
            "b function",
            "addlistener",
            "proof",
            "amazon02",
            "dk summary",
            "amazon rsa",
            "september",
            "browsing",
            "resource",
            "asn16509",
            "name value",
            "queueprogress",
            "timestamp input",
            "status actions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 487,
            "FileHash-SHA1": 461,
            "URL": 10732,
            "domain": 1672,
            "email": 6,
            "hostname": 3039,
            "FileHash-SHA256": 2569,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 18973,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "237 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d91b1a8f414040bfba430",
          "name": "Spyware",
          "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
          "modified": "2025-08-20T00:01:59.498000",
          "created": "2025-07-21T01:02:41.049000",
          "tags": [
            "serving ip",
            "address",
            "status",
            "utc na",
            "utc google",
            "utc facebook",
            "custom audience",
            "tag manager",
            "ua748443502",
            "utc gtmwrp73mt",
            "utc gsrdlm5jnx1",
            "utc aw937838002",
            "adsense na",
            "connect",
            "file type",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "powershell",
            "b file",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "c0002 wininet",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cndigicert sha2",
            "secure server",
            "ca odigicert",
            "inc cus",
            "subject",
            "cnwe1 ogoogle",
            "trust",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft",
            "get http",
            "request",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "united",
            "search",
            "creation date",
            "expiration date",
            "name servers",
            "unknown soa",
            "germany unknown",
            "entries",
            "pulse submit",
            "url analysis",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 304,
            "hostname": 796,
            "URL": 2590,
            "FileHash-SHA256": 2735,
            "FileHash-MD5": 253,
            "FileHash-SHA1": 144,
            "email": 1
          },
          "indicator_count": 6823,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
        "We don\u2019t know how Octoseek & ScoreBlie (Team8)  became part of \u2018No Problems\u2019",
        "Tsara Brashears warned of hack, provided detailed information, provided advice",
        "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse",
        "I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "Many pulses are missing. When we first began using this tool PIT was what we researched first",
        "Palantir Extranet -https://prometheusintelligencetechnology.com/",
        "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
        "IDS Detections: TheMoon.linksys.router",
        "Tsara was unable to finish her second degree this way. But found a way.",
        "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
        "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
        "\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
        "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
        "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
        "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
        "Dean is deceased?  Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
        "Lots of detail because someone , somewhere is going through this.",
        "Old staff slow, foolish but eventually heeded instructions / once it was too late",
        "This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
        "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
        "She was in the botnet already",
        "Find a way to safely begin from a new server. Work from a Virtual World Class",
        "She refused. Two weeks later  man is parked outside of her residence in a different county and city.",
        "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
        "Was denied after third enrollment showed false information",
        "Bills from nowhere appeared. Again staff said this never happened before left her with the debt."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Elf:mirai-aal\\ [trj]",
            "Mirai",
            "Carts.guru",
            "Emotet",
            "Win32:ransomx-gen\\ [ransom]"
          ],
          "industries": [
            "Government",
            "Civil society",
            "Education"
          ],
          "unique_indicators": 33541
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ad-maven.com",
    "whois": "http://whois.domaintools.com/ad-maven.com",
    "domain": "ad-maven.com",
    "hostname": "webflow.ad-maven.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "695035a98f01d94b2598f8ee",
      "name": "Mirai \u2022 PrometheusIntelligenceTechnology.com - Extranet affected Universities | Regis University",
      "description": "PrometheusIntelligenceTechnology.com - Extranet. Regis University experienced an outrageous blackout. I know because I was an outside investigator. Tsara Brashears found the links as a redirect on iOS and MacBook Pro devices.\n She seemed to be the the solely impacted Computer Science student. Further research showed canary cookie in server. Regis ignored all and played down the facts. All computers needed replacing. T advised but they tried to clean them. The elevator didn\u2019t work for years. Call 911 if you get stuck. Tsara went out of her way for 5 months warning them until an fool logged in as her but could only login over iexplorer. RU paid a ransom. Tsara was black listed from school. Above 4.0 GPA 3.8 post assault. Just found another PIT link. \n\nIT Security sent her to the FBI because legitimate death threats and plans were  found. \n\nAll attacks immediately following assault.",
      "modified": "2026-01-26T18:04:20.395000",
      "created": "2025-12-27T19:38:17.198000",
      "tags": [
        "united",
        "unknown aaaa",
        "accept encoding",
        "moved",
        "urls",
        "files",
        "encrypt",
        "passive dns",
        "all ipv4",
        "america flag",
        "america asn",
        "ransom",
        "backdoor",
        "mtb win32",
        "mirai",
        "united states",
        "type indicator",
        "role title",
        "container",
        "ip address",
        "i div",
        "h2 p",
        "h4 p",
        "data",
        "desktop",
        "powerful",
        "url https",
        "url http",
        "indicator role",
        "active related",
        "cidr",
        "types",
        "indicators show",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "spawns",
        "mitre att",
        "ck matrix",
        "command decode",
        "programfiles",
        "suricata ipv4",
        "windir",
        "comspec",
        "hybrid",
        "general",
        "path",
        "model",
        "click",
        "strings",
        "prometheus",
        "palantir",
        "kill list",
        "tracking",
        "moon linksys",
        "router",
        "emotet",
        "active",
        "regis university",
        "ascii text",
        "show technique",
        "pattern match",
        "sha1",
        "show process",
        "root",
        "local",
        "development att",
        "ssl certificate",
        "extranet",
        "maven"
      ],
      "references": [
        "Palantir Extranet -https://prometheusintelligencetechnology.com/",
        "Palantir espionage \u2022 prometheusintelligencetechnology.com \u2022 ad-maven.com \u2022 fastly.com \u2022 Foundry.com \u2022 so many more",
        "IDS Detections: TheMoon.linksys.router",
        "We don\u2019t know how Octoseek & ScoreBlie (Team8)  became part of \u2018No Problems\u2019",
        "It\u2019s okay if it\u2019s in there but this is in NO way related to an Alberta University hack.",
        "This is directed to target, communicated where target was enrolled- Regis University Denver , Co",
        "Pointed to Data Center 5 Inverness / Denver Tech Center, denies relationship. Seemed to prove originating DC",
        "Tsara Brashears warned of hack, provided detailed information, provided advice",
        "\u2018Close enrollment. Get all new devices. Stop using Barracuda.",
        "Find a way to safely begin from a new server. Work from a Virtual World Class",
        "Regis needed to close. They treated Brashears as trash after the NEW staff came. Hmm who are tvey",
        "Old staff slow, foolish but eventually heeded instructions / once it was too late",
        "Dean is deceased?  Was the only staff who insisted that Tsara\u2019s tuition be reimbursed",
        "She was in the botnet already",
        "Was denied after third enrollment showed false information",
        "She sought a certificate from Red Rocks. Kurzweil installed due to being disabled",
        "Bills from nowhere appeared. Again staff said this never happened before left her with the debt.",
        "Tsara was unable to finish her second degree this way. But found a way.",
        "I don\u2019t like finding these remnants. I don\u2019t know why extranet was needed for this Brilliant student",
        "Professors asked to use her papers. \u2018Sure\u2019 she wasn\u2019t impressed",
        "Many pulses are missing. When we first began using this tool PIT was what we researched first",
        "This is when Tsara was interrogated by 2 men at Barnes & No Ken regarding her technical abilities",
        "One of the interrogators, asked her to be his girlfriend (fake ) tried to move her to a new location .",
        "She refused. Two weeks later  man is parked outside of her residence in a different county and city.",
        "I\u2019m concerned because they are attacking people associated with her and thins needs to stop",
        "This is dangerous. What is law enforcement for? They are probably controlled by Palantir as is Trump",
        "Lots of detail because someone , somewhere is going through this."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Win32:RansomX-gen\\ [Ransom]",
          "display_name": "Win32:RansomX-gen\\ [Ransom]",
          "target": null
        },
        {
          "id": "ELF:Mirai-AAL\\ [Trj]",
          "display_name": "ELF:Mirai-AAL\\ [Trj]",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1553.001",
          "name": "Gatekeeper Bypass",
          "display_name": "T1553.001 - Gatekeeper Bypass"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 5,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1037,
        "domain": 161,
        "hostname": 340,
        "email": 2,
        "FileHash-SHA256": 315,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 20,
        "CIDR": 16,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 1913,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "83 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695043197c2fbfda85abc1d4",
      "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
      "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
      "modified": "2025-12-27T20:35:37.012000",
      "created": "2025-12-27T20:35:37.012000",
      "tags": [
        "Palantir",
        "Ad- Maven",
        "Prometheus Intelligence Technology"
      ],
      "references": [
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Carts.Guru",
          "display_name": "Carts.Guru",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Education",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 82,
        "hostname": 180,
        "URL": 995,
        "FileHash-SHA256": 110
      },
      "indicator_count": 1367,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "113 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688716977e80a4274f2eafa9",
      "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
      "description": "Found in Bot joining Pulse.",
      "modified": "2025-08-27T06:03:05.020000",
      "created": "2025-07-28T06:20:07.660000",
      "tags": [
        "present jul",
        "united",
        "entries",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "body",
        "meta",
        "passive dns",
        "next associated",
        "win32spigot apr",
        "title error",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "files",
        "adaptivebee",
        "worm",
        "win32",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "location united",
        "asn asnone",
        "nameservers",
        "less whois",
        "registrar",
        "csc corporate",
        "status",
        "servers",
        "name servers",
        "hostname",
        "hostname add",
        "a domains",
        "script urls",
        "unknown aaaa",
        "technology one",
        "script script",
        "certificate",
        "null",
        "trojan",
        "twitter",
        "domain",
        "files ip",
        "address domain",
        "ip related",
        "pulses otx",
        "virtool",
        "http",
        "present jun",
        "present may",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "australia asn",
        "as55532 squiz",
        "dns resolutions",
        "overview ip",
        "address",
        "ipv4",
        "iocs",
        "data upload",
        "extraction",
        "ided iocs",
        "failed",
        "shaw",
        "ail tvnas",
        "rl irl",
        "domain add",
        "ostname add",
        "verdict",
        "show",
        "types",
        "type",
        "indicator data",
        "searc type",
        "a indicator",
        "data",
        "select across",
        "all pages",
        "domain domain",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "msie",
        "chrome",
        "present dec",
        "base",
        "read c",
        "port",
        "destination",
        "delete",
        "copy",
        "write",
        "memcommit",
        "cryptexportkey",
        "invalid pointer",
        "writeconsolea",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "ascii text",
        "crlf line",
        "mitre att",
        "error",
        "click",
        "hybrid",
        "local",
        "path",
        "starfield",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "form",
        "adversaries",
        "windows nt",
        "generic http",
        "exe upload",
        "inbound",
        "outbound",
        "yara detections",
        "malware",
        "expiration date",
        "whois show",
        "name andrew",
        "bauer name",
        "div id",
        "beginstring",
        "beginerror",
        "script",
        "general",
        "cloud",
        "find",
        "footer",
        "ninite feb",
        "telper",
        "ninite mar",
        "ninite apr",
        "trojandropper",
        "mtb mar",
        "url https",
        "general full",
        "security tls",
        "software",
        "resource hash",
        "protocol h2",
        "frankfurt",
        "main",
        "germany",
        "input",
        "skype",
        "opciones",
        "july",
        "es form",
        "dom name",
        "post https",
        "imagen",
        "microsoft",
        "iniciar sesin",
        "value",
        "variables",
        "config",
        "debug",
        "loader",
        "geturl",
        "b function",
        "addlistener",
        "proof",
        "amazon02",
        "dk summary",
        "amazon rsa",
        "september",
        "browsing",
        "resource",
        "asn16509",
        "name value",
        "queueprogress",
        "timestamp input",
        "status actions"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 487,
        "FileHash-SHA1": 461,
        "URL": 10732,
        "domain": 1672,
        "email": 6,
        "hostname": 3039,
        "FileHash-SHA256": 2569,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 18973,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "237 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d91b1a8f414040bfba430",
      "name": "Spyware",
      "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
      "modified": "2025-08-20T00:01:59.498000",
      "created": "2025-07-21T01:02:41.049000",
      "tags": [
        "serving ip",
        "address",
        "status",
        "utc na",
        "utc google",
        "utc facebook",
        "custom audience",
        "tag manager",
        "ua748443502",
        "utc gtmwrp73mt",
        "utc gsrdlm5jnx1",
        "utc aw937838002",
        "adsense na",
        "connect",
        "file type",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "powershell",
        "b file",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "c0002 wininet",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cndigicert sha2",
        "secure server",
        "ca odigicert",
        "inc cus",
        "subject",
        "cnwe1 ogoogle",
        "trust",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft",
        "get http",
        "request",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "response",
        "united",
        "search",
        "creation date",
        "expiration date",
        "name servers",
        "unknown soa",
        "germany unknown",
        "entries",
        "pulse submit",
        "url analysis",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 304,
        "hostname": 796,
        "URL": 2590,
        "FileHash-SHA256": 2735,
        "FileHash-MD5": 253,
        "FileHash-SHA1": 144,
        "email": 1
      },
      "indicator_count": 6823,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://webflow.ad-maven.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://webflow.ad-maven.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776695134.2033615
}