{
  "type": "URL",
  "indicator": "https://ww1.telstraclear.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ww1.telstraclear.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833893785,
      "indicator": "https://ww1.telstraclear.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "687605f986433ebf2673f0b8",
          "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring",
          "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}",
          "modified": "2025-08-14T07:05:00.239000",
          "created": "2025-07-15T07:40:41.180000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "entries",
            "gmt etag",
            "server",
            "ecacc",
            "serving ip",
            "address",
            "dom dom",
            "data upload",
            "extraction",
            "pdf report",
            "enter",
            "failed",
            "extraction data",
            "enter sc",
            "type",
            "extra data",
            "extri please",
            "review data",
            "excluded tous",
            "tui sugges",
            "find",
            "show",
            "at filer",
            "iocs",
            "levelbluelabs",
            "please",
            "included iocs",
            "excluded io",
            "find suggested",
            "types",
            "domain data",
            "search",
            "o please",
            "manually add",
            "c data",
            "o suggesteo",
            "include data",
            "review uus",
            "u exclude",
            "find s",
            "indicaok data",
            "dom doman",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "copy",
            "push",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "utf8",
            "null",
            "refresh",
            "body",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "evasion att",
            "t1480 execution",
            "discovery att"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3597,
            "FileHash-MD5": 343,
            "domain": 547,
            "hostname": 1222,
            "FileHash-SHA1": 343,
            "FileHash-SHA256": 4464,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 10518,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 26796
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/telstraclear.net",
    "whois": "http://whois.domaintools.com/telstraclear.net",
    "domain": "telstraclear.net",
    "hostname": "ww1.telstraclear.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "687605f986433ebf2673f0b8",
      "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring",
      "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}",
      "modified": "2025-08-14T07:05:00.239000",
      "created": "2025-07-15T07:40:41.180000",
      "tags": [
        "url http",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "entries",
        "gmt etag",
        "server",
        "ecacc",
        "serving ip",
        "address",
        "dom dom",
        "data upload",
        "extraction",
        "pdf report",
        "enter",
        "failed",
        "extraction data",
        "enter sc",
        "type",
        "extra data",
        "extri please",
        "review data",
        "excluded tous",
        "tui sugges",
        "find",
        "show",
        "at filer",
        "iocs",
        "levelbluelabs",
        "please",
        "included iocs",
        "excluded io",
        "find suggested",
        "types",
        "domain data",
        "search",
        "o please",
        "manually add",
        "c data",
        "o suggesteo",
        "include data",
        "review uus",
        "u exclude",
        "find s",
        "indicaok data",
        "dom doman",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "copy",
        "push",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "ascii text",
        "size",
        "mitre att",
        "utf8",
        "null",
        "refresh",
        "body",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "evasion att",
        "t1480 execution",
        "discovery att"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3597,
        "FileHash-MD5": 343,
        "domain": 547,
        "hostname": 1222,
        "FileHash-SHA1": 343,
        "FileHash-SHA256": 4464,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 10518,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ww1.telstraclear.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ww1.telstraclear.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641497.2231095
}