{
  "type": "URL",
  "indicator": "https://ww1.security-updater.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ww1.security-updater.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3169302721,
      "indicator": "https://ww1.security-updater.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68ddea7d79d06d06002c8633",
          "name": "E-PRODIGY.COM | ACHCAPITAL.COM",
          "description": "I need to update this soon",
          "modified": "2025-11-01T01:01:18.619000",
          "created": "2025-10-02T02:59:09.210000",
          "tags": [
            "portsmouth",
            "united kingdom",
            "cogecopeer1",
            "securehost",
            "united",
            "ashburn",
            "amazonaes",
            "wiesbaden",
            "virgin islands",
            "wqrmholdings",
            "nashville",
            "asnvins",
            "chicago",
            "quickpacket",
            "kansas city"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "gameprofits.io",
            "id": "170823",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_170823/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 313,
            "hostname": 246,
            "URL": 1416,
            "FileHash-SHA256": 175
          },
          "indicator_count": 2150,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "169 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c7b86fa120d19bbc88f367",
          "name": "Hijacker",
          "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
          "modified": "2024-03-11T17:01:59.026000",
          "created": "2024-02-10T17:54:55.243000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "tsara brashears",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "high level",
            "hackers",
            "hacktool",
            "download",
            "malware",
            "crypto",
            "hijacker",
            "monitoring",
            "installer",
            "tofsee",
            "domains domains",
            "domains files",
            "files files",
            "script",
            "kgs0",
            "kls0",
            "relic",
            "iframe",
            "pe32 executable",
            "ms windows",
            "intel",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "rticon neutral",
            "info compiler",
            "products id",
            "header intel",
            "name md5",
            "contained",
            "type",
            "language",
            "ico rtgroupicon",
            "neutral",
            "first",
            "utc submissions",
            "submitters",
            "company limited",
            "computer",
            "amazonaes",
            "china telecom",
            "group",
            "csc corporate",
            "domains",
            "malware spreading evader",
            "cnc",
            "malvertizing",
            "milehighmedia",
            "trojandropper",
            "moved",
            "passive dns",
            "urls",
            "as14576",
            "backdoor",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "trojan",
            "encrypt",
            "body",
            "date",
            "date hash",
            "avast avg",
            "mtb may",
            "kratona",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls https",
            "script urls",
            "united",
            "meta",
            "unknown",
            "emails",
            "name servers",
            "search",
            "as62597 nsone",
            "a domains",
            "as397241",
            "media",
            "next",
            "december",
            "unlocker",
            "threat round",
            "apple ios",
            "apple phone",
            "project",
            "blister",
            "agent tesla",
            "open",
            "execution",
            "videos",
            "strong",
            "porn videos",
            "watch",
            "daddy",
            "free",
            "top rated",
            "most viewed",
            "cancel anytime",
            "views",
            "play",
            "black",
            "enjoy",
            "czech",
            "hunk",
            "virtool",
            "cryp",
            "creation date",
            "otx telemetry",
            "expiration date",
            "servers",
            "status",
            "win32",
            "showing",
            "domain",
            "nxdomain",
            "as8075",
            "shell code",
            "threat",
            "cyber espionage",
            "cyber stalking",
            "danger",
            "critical",
            "attack",
            "treats",
            "as15169 google",
            "aaaa",
            "record value",
            "error",
            "entries",
            "hostname",
            "url http",
            "http",
            "files domain",
            "files related",
            "shinjiru msc",
            "sdn bhd",
            "dnssec",
            "protect",
            "as54455 madeit",
            "phishing",
            "backdoor",
            "contextualizing",
            "elevated exposure",
            "malvertizing",
            "ransom",
            "msil",
            "hackers for hire",
            "hashes",
            "http method",
            "get http",
            "http requests",
            "get dns",
            "ip traffic",
            "memory pattern",
            "pattern ips",
            "@emreimer",
            "iextract2",
            "cp cyber",
            "denver",
            "security",
            "siem compliance",
            "skip",
            "cybersecurity",
            "larimer st",
            "suite",
            "resources cyber",
            "risk assessment",
            "bill",
            "mind",
            "delaware",
            "pa",
            "arizona",
            "colorado",
            "stalkers",
            "deuteronomy 28:7",
            "hitmen"
          ],
          "references": [
            "honey.exe",
            "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
            "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
            "CS Sigma Rules: Python Initiated Connection by frack113",
            "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
            "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
            "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
            "api.login.live.com",
            "http://appleid.icloud.com-website33.org/",
            "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
            "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
            "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
            "message.htm.com",
            "http://pornhub.com/gay/video/search",
            "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
            "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "W32.Sality.PE",
              "display_name": "W32.Sality.PE",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Virus.Win32.Virut.q",
              "display_name": "Virus.Win32.Virut.q",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32",
              "display_name": "TrojanDropper:Win32",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 54,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6303,
            "FileHash-MD5": 215,
            "FileHash-SHA1": 192,
            "FileHash-SHA256": 2663,
            "domain": 2673,
            "hostname": 2686,
            "CVE": 2,
            "email": 16
          },
          "indicator_count": 14750,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65575839f772f9f944f7af94",
          "name": "Command and Scripting Interpreter | www.supernetforme.com",
          "description": "",
          "modified": "2023-12-17T11:03:45.376000",
          "created": "2023-11-17T12:10:33.958000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "communicating",
            "referrer",
            "june",
            "july",
            "october",
            "historical ssl",
            "malware",
            "august",
            "path",
            "treatas",
            "hkcuclsid",
            "document file",
            "v2 document",
            "sha256",
            "ascii text",
            "size",
            "type data",
            "html document",
            "february",
            "hybrid",
            "general",
            "local",
            "factory",
            "click",
            "strings",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "error",
            "unknown",
            "generator",
            "critical",
            "body",
            "info",
            "trace",
            "void",
            "c2",
            "trojan",
            "parked domain",
            "registrar abuse",
            "tracking",
            "deep search",
            "command_and_control"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "AI Packer",
              "display_name": "AI Packer",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Banto",
              "display_name": "Banto",
              "target": null
            },
            {
              "id": "Matrix",
              "display_name": "Matrix",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 368,
            "FileHash-MD5": 81,
            "FileHash-SHA1": 76,
            "FileHash-SHA256": 1015,
            "URL": 1639,
            "domain": 329
          },
          "indicator_count": 3508,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "854 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707dbbb0493c03ba107643",
          "name": "loggly.com and pstv.com/ supernetforme.com live malware",
          "description": "",
          "modified": "2023-12-06T13:57:15.377000",
          "created": "2023-12-06T13:57:15.377000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1933,
            "domain": 1302,
            "hostname": 805,
            "URL": 3593,
            "FileHash-MD5": 1
          },
          "indicator_count": 7635,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "61f9b4b2c6c645e9839112b2",
          "name": "loggly.com and pstv.com/ supernetforme.com live malware",
          "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com",
          "modified": "2022-03-04T00:00:56.902000",
          "created": "2022-02-01T22:31:14.017000",
          "tags": [
            "irst seen",
            "date",
            "file sha256",
            "network related",
            "malicious",
            "found"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3593,
            "FileHash-SHA256": 1933,
            "hostname": 805,
            "domain": 1302,
            "FileHash-MD5": 1,
            "CVE": 1
          },
          "indicator_count": 7635,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 397,
          "modified_text": "1507 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "http://appleid.icloud.com-website33.org/",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "message.htm.com",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "http://pornhub.com/gay/video/search",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "api.login.live.com",
        "honey.exe",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojandropper:win32",
            "Tofsee",
            "Relic",
            "W32.sality.pe",
            "Virus.win32.virut.q",
            "Trojanspy",
            "Trojan",
            "Unruy",
            "Virtool",
            "Banto",
            "Hacktool",
            "Matrix",
            "Ai packer"
          ],
          "industries": [],
          "unique_indicators": 26462
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/security-updater.com",
    "whois": "http://whois.domaintools.com/security-updater.com",
    "domain": "security-updater.com",
    "hostname": "ww1.security-updater.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68ddea7d79d06d06002c8633",
      "name": "E-PRODIGY.COM | ACHCAPITAL.COM",
      "description": "I need to update this soon",
      "modified": "2025-11-01T01:01:18.619000",
      "created": "2025-10-02T02:59:09.210000",
      "tags": [
        "portsmouth",
        "united kingdom",
        "cogecopeer1",
        "securehost",
        "united",
        "ashburn",
        "amazonaes",
        "wiesbaden",
        "virgin islands",
        "wqrmholdings",
        "nashville",
        "asnvins",
        "chicago",
        "quickpacket",
        "kansas city"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "gameprofits.io",
        "id": "170823",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_170823/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 313,
        "hostname": 246,
        "URL": 1416,
        "FileHash-SHA256": 175
      },
      "indicator_count": 2150,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "169 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c7b86fa120d19bbc88f367",
      "name": "Hijacker",
      "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
      "modified": "2024-03-11T17:01:59.026000",
      "created": "2024-02-10T17:54:55.243000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "tsara brashears",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "high level",
        "hackers",
        "hacktool",
        "download",
        "malware",
        "crypto",
        "hijacker",
        "monitoring",
        "installer",
        "tofsee",
        "domains domains",
        "domains files",
        "files files",
        "script",
        "kgs0",
        "kls0",
        "relic",
        "iframe",
        "pe32 executable",
        "ms windows",
        "intel",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "rticon neutral",
        "info compiler",
        "products id",
        "header intel",
        "name md5",
        "contained",
        "type",
        "language",
        "ico rtgroupicon",
        "neutral",
        "first",
        "utc submissions",
        "submitters",
        "company limited",
        "computer",
        "amazonaes",
        "china telecom",
        "group",
        "csc corporate",
        "domains",
        "malware spreading evader",
        "cnc",
        "malvertizing",
        "milehighmedia",
        "trojandropper",
        "moved",
        "passive dns",
        "urls",
        "as14576",
        "backdoor",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "trojan",
        "encrypt",
        "body",
        "date",
        "date hash",
        "avast avg",
        "mtb may",
        "kratona",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls https",
        "script urls",
        "united",
        "meta",
        "unknown",
        "emails",
        "name servers",
        "search",
        "as62597 nsone",
        "a domains",
        "as397241",
        "media",
        "next",
        "december",
        "unlocker",
        "threat round",
        "apple ios",
        "apple phone",
        "project",
        "blister",
        "agent tesla",
        "open",
        "execution",
        "videos",
        "strong",
        "porn videos",
        "watch",
        "daddy",
        "free",
        "top rated",
        "most viewed",
        "cancel anytime",
        "views",
        "play",
        "black",
        "enjoy",
        "czech",
        "hunk",
        "virtool",
        "cryp",
        "creation date",
        "otx telemetry",
        "expiration date",
        "servers",
        "status",
        "win32",
        "showing",
        "domain",
        "nxdomain",
        "as8075",
        "shell code",
        "threat",
        "cyber espionage",
        "cyber stalking",
        "danger",
        "critical",
        "attack",
        "treats",
        "as15169 google",
        "aaaa",
        "record value",
        "error",
        "entries",
        "hostname",
        "url http",
        "http",
        "files domain",
        "files related",
        "shinjiru msc",
        "sdn bhd",
        "dnssec",
        "protect",
        "as54455 madeit",
        "phishing",
        "backdoor",
        "contextualizing",
        "elevated exposure",
        "malvertizing",
        "ransom",
        "msil",
        "hackers for hire",
        "hashes",
        "http method",
        "get http",
        "http requests",
        "get dns",
        "ip traffic",
        "memory pattern",
        "pattern ips",
        "@emreimer",
        "iextract2",
        "cp cyber",
        "denver",
        "security",
        "siem compliance",
        "skip",
        "cybersecurity",
        "larimer st",
        "suite",
        "resources cyber",
        "risk assessment",
        "bill",
        "mind",
        "delaware",
        "pa",
        "arizona",
        "colorado",
        "stalkers",
        "deuteronomy 28:7",
        "hitmen"
      ],
      "references": [
        "honey.exe",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "api.login.live.com",
        "http://appleid.icloud.com-website33.org/",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "message.htm.com",
        "http://pornhub.com/gay/video/search",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "W32.Sality.PE",
          "display_name": "W32.Sality.PE",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Virus.Win32.Virut.q",
          "display_name": "Virus.Win32.Virut.q",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32",
          "display_name": "TrojanDropper:Win32",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 54,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6303,
        "FileHash-MD5": 215,
        "FileHash-SHA1": 192,
        "FileHash-SHA256": 2663,
        "domain": 2673,
        "hostname": 2686,
        "CVE": 2,
        "email": 16
      },
      "indicator_count": 14750,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65575839f772f9f944f7af94",
      "name": "Command and Scripting Interpreter | www.supernetforme.com",
      "description": "",
      "modified": "2023-12-17T11:03:45.376000",
      "created": "2023-11-17T12:10:33.958000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "communicating",
        "referrer",
        "june",
        "july",
        "october",
        "historical ssl",
        "malware",
        "august",
        "path",
        "treatas",
        "hkcuclsid",
        "document file",
        "v2 document",
        "sha256",
        "ascii text",
        "size",
        "type data",
        "html document",
        "february",
        "hybrid",
        "general",
        "local",
        "factory",
        "click",
        "strings",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "error",
        "unknown",
        "generator",
        "critical",
        "body",
        "info",
        "trace",
        "void",
        "c2",
        "trojan",
        "parked domain",
        "registrar abuse",
        "tracking",
        "deep search",
        "command_and_control"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "AI Packer",
          "display_name": "AI Packer",
          "target": null
        },
        {
          "id": "Trojan",
          "display_name": "Trojan",
          "target": null
        },
        {
          "id": "Banto",
          "display_name": "Banto",
          "target": null
        },
        {
          "id": "Matrix",
          "display_name": "Matrix",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 368,
        "FileHash-MD5": 81,
        "FileHash-SHA1": 76,
        "FileHash-SHA256": 1015,
        "URL": 1639,
        "domain": 329
      },
      "indicator_count": 3508,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "854 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707dbbb0493c03ba107643",
      "name": "loggly.com and pstv.com/ supernetforme.com live malware",
      "description": "",
      "modified": "2023-12-06T13:57:15.377000",
      "created": "2023-12-06T13:57:15.377000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 1933,
        "domain": 1302,
        "hostname": 805,
        "URL": 3593,
        "FileHash-MD5": 1
      },
      "indicator_count": 7635,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "61f9b4b2c6c645e9839112b2",
      "name": "loggly.com and pstv.com/ supernetforme.com live malware",
      "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com",
      "modified": "2022-03-04T00:00:56.902000",
      "created": "2022-02-01T22:31:14.017000",
      "tags": [
        "irst seen",
        "date",
        "file sha256",
        "network related",
        "malicious",
        "found"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3593,
        "FileHash-SHA256": 1933,
        "hostname": 805,
        "domain": 1302,
        "FileHash-MD5": 1,
        "CVE": 1
      },
      "indicator_count": 7635,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 397,
      "modified_text": "1507 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ww1.security-updater.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ww1.security-updater.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642235.7485096
}