{
  "type": "URL",
  "indicator": "https://ww25.odapps.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ww25.odapps.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3832590593,
      "indicator": "https://ww25.odapps.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "693b7dc3cf1996347652ef92",
          "name": "Google Site Redirector - Tesla Hackers",
          "description": "Silencing. By Tesla hackers. Awful example of how any victim of a crime; can become a target of the government..\nThis is especially true when the actual perpetrators work for the government are government affiliated, very wealthy, a celebrity or someone who is deemed important. In this instance the Quasi government sought to keep target seeking and obtaining life saving medical treatment, financial settlement that she was entitled to from assault, injuries from assault, false imprisonment, punitive damgages, pain and suffering, humiliation, premise liability, permanent (whole body disability @MMI ), many other crimes. The victims suffered from a great sadness and betrayal. \n\nObviously racist Elon Musk and crew have access to all government tools. Musk, All things cyber are at his disposal as \ncontinues to abuse privilege.\n They keep  playing a God  they  don\u2019t believe in. God is the Ultimate Avenger.",
          "modified": "2026-01-11T00:03:08.581000",
          "created": "2025-12-12T02:28:19.107000",
          "tags": [
            "compromised_site_redirector_fromcharcode",
            "site_redirector",
            "string",
            "regexp",
            "error",
            "number",
            "sxa0",
            "amptoken",
            "optout",
            "retrieving",
            "notfound",
            "write",
            "form",
            "flash",
            "vd",
            "tesla hackers",
            "nxdomain",
            "passive dns",
            "ip address",
            "domain",
            "a nxdomain",
            "urls",
            "files",
            "ip related",
            "pulses otx",
            "google",
            "unknown",
            "oracle",
            "dynamicloader",
            "medium",
            "high",
            "windows",
            "rndhex",
            "write c",
            "rndchar",
            "displayname",
            "tofsee",
            "yara rule",
            "stream",
            "strings",
            "push",
            "lte all",
            "search otx",
            "ource url",
            "or text",
            "paste",
            "data upload",
            "extraction",
            "elon musk",
            "indicator role",
            "active related",
            "ipv4",
            "exploitsource",
            "url https",
            "url http",
            "desktopinternet",
            "title added",
            "pulses ipv4",
            "less see",
            "ids detections",
            "vuze bt",
            "udp connection",
            "contacted",
            "filehash",
            "av detections",
            "yara detections",
            "alerts",
            "0x8aa42",
            "0xe3107",
            "upnp",
            "http request",
            "bittorrent",
            "file",
            "module load",
            "t1129",
            "post http",
            "install",
            "execution",
            "malware",
            "hostile",
            "crawl",
            "windows nt",
            "wow64",
            "get zona",
            "get httpget",
            "hash",
            "entries",
            "read c",
            "suspicious",
            "next",
            "united"
          ],
          "references": [
            "Tesla Hackers  | https://www.teslarati.com/spacex",
            "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
            "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
            "IDS Detections Win32/ZonaInstaller Install Beacon",
            "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
            "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
            "https://www.google-analytics.com/debug/bootstrap?id=\\",
            "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
            "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
            "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
            "This is why our team tells a back story. It can and does happen to anyone.",
            "We apologize for so may typos and errors. We strive to do better at that."
          ],
          "public": 1,
          "adversary": "Tesla Hackers",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Vd",
              "display_name": "Vd",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Win.Trojan.12382640-1",
              "display_name": "Win.Trojan.12382640-1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 65,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 2032,
            "URL": 4921,
            "domain": 567,
            "hostname": 1586,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "99 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "674ea53a3509f6554438cfb6",
          "name": "extrapolation from some ips in 2023 report",
          "description": "",
          "modified": "2025-06-02T19:58:17.107000",
          "created": "2024-12-03T06:29:14.674000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1131,
            "hostname": 2551,
            "domain": 1669,
            "URL": 6806,
            "CVE": 1
          },
          "indicator_count": 12158,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 184,
          "modified_text": "322 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d053a935bf99f5263deb57",
          "name": "History Killer Pro Injection deleting virustotal & otx.alienvault Pulses",
          "description": "History killer pro, is being used to delete and modify virustotal nodes and 41 otx.alienvault pulses. Junk data is being used to fill in missing pulses.\nTargeted: 1 callmeDoris  several scoreblue (sometimes I clone pulses) Octoseek.  \npulses.\nHallrender, Metro by T-Mobile, https://myaccount.uscis.gov/, Esurance,  40 pule reports are regarding Tsara Brashears cyber bully campaign which attacked the corporates mentioned except 2 AIG and Hallrender attackers. 100's of other modifications, deletions by another tool affecting several users.",
          "modified": "2024-03-18T04:01:27.756000",
          "created": "2024-02-17T06:35:21.666000",
          "tags": [
            "contacted",
            "execution",
            "january",
            "september",
            "whois record",
            "resolutions",
            "communicating",
            "roundup",
            "highly targeted",
            "phishing",
            "quasar",
            "malware",
            "open",
            "threat roundup",
            "referrer",
            "remote",
            "kimsuky",
            "passive dns",
            "urls",
            "dive domains",
            "creation date",
            "search",
            "record value",
            "date",
            "united",
            "scan endpoints",
            "all scoreblue",
            "unknown",
            "body",
            "brian sabey",
            "hall render",
            "reinsurance",
            "state",
            "danger",
            "threat",
            "critical",
            "crypthashdata",
            "read c",
            "tcmiheijkmutcix",
            "entries",
            "show",
            "t1055",
            "intel",
            "ms windows",
            "delphi",
            "win32",
            "copy",
            "write",
            "injection",
            "zusy",
            "neojit",
            "cyber stalking",
            "worker",
            "inject",
            "illegal",
            "tampering",
            "hijacker",
            "delete",
            "ret hat",
            "stalker",
            "shadow",
            "quasi"
          ],
          "references": [
            "www.historykillerpro.com",
            "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
            "http://sniper.debugger.ru",
            "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Variant.Zusy.572 Checkin",
              "display_name": "Variant.Zusy.572 Checkin",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Neojit.A",
              "display_name": "TrojanDownloader:Win32/Neojit.A",
              "target": "/malware/TrojanDownloader:Win32/Neojit.A"
            },
            {
              "id": "Win32:Delf-SES\\ [Trj]",
              "display_name": "Win32:Delf-SES\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1372316",
              "display_name": "Win.Trojan.Agent-1372316",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1915,
            "FileHash-MD5": 437,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 3054,
            "domain": 987,
            "URL": 5902,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 12732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "763 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d0a9c7f1b04296d9b0d803",
          "name": "History Killer Pro Injection deleting VirusTotal & OTX.AlienVault Pulses",
          "description": "",
          "modified": "2024-03-18T04:01:27.756000",
          "created": "2024-02-17T12:42:47.334000",
          "tags": [
            "contacted",
            "execution",
            "january",
            "september",
            "whois record",
            "resolutions",
            "communicating",
            "roundup",
            "highly targeted",
            "phishing",
            "quasar",
            "malware",
            "open",
            "threat roundup",
            "referrer",
            "remote",
            "kimsuky",
            "passive dns",
            "urls",
            "dive domains",
            "creation date",
            "search",
            "record value",
            "date",
            "united",
            "scan endpoints",
            "all scoreblue",
            "unknown",
            "body",
            "brian sabey",
            "hall render",
            "reinsurance",
            "state",
            "danger",
            "threat",
            "critical",
            "crypthashdata",
            "read c",
            "tcmiheijkmutcix",
            "entries",
            "show",
            "t1055",
            "intel",
            "ms windows",
            "delphi",
            "win32",
            "copy",
            "write",
            "injection",
            "zusy",
            "neojit",
            "cyber stalking",
            "worker",
            "inject",
            "illegal",
            "tampering",
            "hijacker",
            "delete",
            "ret hat",
            "stalker",
            "shadow",
            "quasi"
          ],
          "references": [
            "www.historykillerpro.com",
            "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
            "http://sniper.debugger.ru",
            "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Variant.Zusy.572 Checkin",
              "display_name": "Variant.Zusy.572 Checkin",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Neojit.A",
              "display_name": "TrojanDownloader:Win32/Neojit.A",
              "target": "/malware/TrojanDownloader:Win32/Neojit.A"
            },
            {
              "id": "Win32:Delf-SES\\ [Trj]",
              "display_name": "Win32:Delf-SES\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1372316",
              "display_name": "Win.Trojan.Agent-1372316",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65d053a935bf99f5263deb57",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1915,
            "FileHash-MD5": 437,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 3054,
            "domain": 987,
            "URL": 5902,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 12732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "763 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb4768b06f4da2fba5959b",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:44.270000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "767 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb476d0566c2d07e474df5",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:49.140000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "767 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb476d935dd560b4a3e938",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:49.380000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "767 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cb4772c3d3ad1f7accc98a",
          "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
          "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
          "modified": "2024-03-14T09:04:37.097000",
          "created": "2024-02-13T10:41:53.179000",
          "tags": [
            "contacted",
            "ssl certificate",
            "contacted urls",
            "whois record",
            "whois whois",
            "relacionada",
            "execution",
            "p2404",
            "kgs0",
            "kls0",
            "lockbit",
            "lolkek",
            "emotet",
            "phishing",
            "ursnif",
            "malware",
            "core",
            "ryuk ransomware",
            "qakbot",
            "makop",
            "hacktool",
            "chaos",
            "ransomexx",
            "temp",
            "localappdata",
            "pattern match",
            "ascii text",
            "json data",
            "united",
            "indicator",
            "prefetch8",
            "observed email",
            "unicode text",
            "date",
            "hybrid",
            "win64",
            "general",
            "click",
            "strings",
            "tsara brashears",
            "suspicious",
            "falcon",
            "name verdict",
            "reinsurance",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as13335",
            "title",
            "gmt server",
            "user agent",
            "443 ma2592000",
            "hostname",
            "encrypt",
            "script urls",
            "t matrix",
            "dch v",
            "meta",
            "trang ch",
            "body",
            "status",
            "search",
            "creation date",
            "record value",
            "domain name",
            "litespeed",
            "certificate",
            "speed",
            "next",
            "unknown",
            "ipv4",
            "reverse dns",
            "name servers",
            "expiration date",
            "showing",
            "pulse submit",
            "gandi sas",
            "moved",
            "emails",
            "servers",
            "error",
            "russia unknown",
            "as31483",
            "as12768",
            "as30943",
            "united kingdom",
            "as208722 yandex",
            "cname",
            "spyware",
            "tracking",
            "login"
          ],
          "references": [
            "workers.dev [extraction \u2022 GET request attack]",
            "ddos.dnsnb8.net [command_and_control]",
            "www.supernetforme.com  [command_and_control]",
            "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
            "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
            "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
            "CVE: CVE-2023-23397",
            "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
            "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://twitter.com/PORNO_SEXYBABES",
            "sex-ukraine.net",
            "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
            "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
            "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
            "nexus.b2btest.ertelecom.ru",
            "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
            "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
            "http://micrologin.ogspy.net/track/dhl-information-contact.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Ryuk Ransomware",
              "display_name": "Ryuk Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 127,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 4862,
            "hostname": 3571,
            "URL": 10597,
            "CVE": 3,
            "domain": 3169,
            "email": 7
          },
          "indicator_count": 22461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "767 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b93e70b75e7dce7168f4dd",
          "name": "Google - Lumma Stealer| QakBot | Emotet",
          "description": "Lumma is classified as a stealer - a type of malware that extracts sensitive information from infected devices.\n\nYou can't see it. You will see https://www.google.com and your search. It's hidden spyware. extremely malicious. Targeted individual.",
          "modified": "2024-02-29T17:01:09.717000",
          "created": "2024-01-30T18:22:40.905000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "historical ssl",
            "referrer",
            "urls url",
            "whois whois",
            "october",
            "resolutions",
            "august",
            "execution",
            "installer",
            "iframe",
            "malware",
            "core",
            "emotet",
            "lumma stealer",
            "ransomexx",
            "azorult",
            "ursnif",
            "hacktool",
            "june",
            "qakbot",
            "qbot",
            "april",
            "targeting",
            "tsara brashears",
            "active threat"
          ],
          "references": [
            "google.com.uy [Google search browser, masked, links to malicious porn malware spreader, malvertizing, collection host]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password cracker]",
            "toolbarqueries.google.com.uy"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Azorult",
              "display_name": "Azorult",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "Qbot",
              "display_name": "Qbot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1030",
              "name": "Data Transfer Size Limits",
              "display_name": "T1030 - Data Transfer Size Limits"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 50,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 3377,
            "hostname": 2502,
            "URL": 8531,
            "domain": 1250,
            "CVE": 2
          },
          "indicator_count": 15758,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "CVE: CVE-2023-23397",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
        "toolbarqueries.google.com.uy",
        "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
        "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
        "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
        "We apologize for so may typos and errors. We strive to do better at that.",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "http://sniper.debugger.ru",
        "IDS Detections Win32/ZonaInstaller Install Beacon",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "google.com.uy [Google search browser, masked, links to malicious porn malware spreader, malvertizing, collection host]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
        "www.supernetforme.com  [command_and_control]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.google-analytics.com/debug/bootstrap?id=\\",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://twitter.com/PORNO_SEXYBABES",
        "nexus.b2btest.ertelecom.ru",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password cracker]",
        "sex-ukraine.net",
        "Tesla Hackers  | https://www.teslarati.com/spacex",
        "This is why our team tells a back story. It can and does happen to anyone.",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "workers.dev [extraction \u2022 GET request attack]",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "www.historykillerpro.com",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany",
        "ddos.dnsnb8.net [command_and_control]",
        "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Tesla Hackers"
          ],
          "malware_families": [
            "Lolkek",
            "Malware",
            "Sabey",
            "Win.trojan.agent-1372316",
            "Lumma stealer",
            "Qbot",
            "Win.trojan.12382640-1",
            "Trojandownloader:win32/neojit.a",
            "Makop",
            "Ransomexx",
            "Ryuk ransomware",
            "Hallrender",
            "Win32:delf-ses\\ [trj]",
            "Vd",
            "Lockbit",
            "Qakbot",
            "Variant.zusy.572 checkin",
            "Emotet",
            "Ursnif",
            "Hacktool",
            "Hallgrand",
            "Azorult",
            "Backdoor:win32/tofsee.t"
          ],
          "industries": [
            "Civil society"
          ],
          "unique_indicators": 76394
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/odapps.net",
    "whois": "http://whois.domaintools.com/odapps.net",
    "domain": "odapps.net",
    "hostname": "ww25.odapps.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "693b7dc3cf1996347652ef92",
      "name": "Google Site Redirector - Tesla Hackers",
      "description": "Silencing. By Tesla hackers. Awful example of how any victim of a crime; can become a target of the government..\nThis is especially true when the actual perpetrators work for the government are government affiliated, very wealthy, a celebrity or someone who is deemed important. In this instance the Quasi government sought to keep target seeking and obtaining life saving medical treatment, financial settlement that she was entitled to from assault, injuries from assault, false imprisonment, punitive damgages, pain and suffering, humiliation, premise liability, permanent (whole body disability @MMI ), many other crimes. The victims suffered from a great sadness and betrayal. \n\nObviously racist Elon Musk and crew have access to all government tools. Musk, All things cyber are at his disposal as \ncontinues to abuse privilege.\n They keep  playing a God  they  don\u2019t believe in. God is the Ultimate Avenger.",
      "modified": "2026-01-11T00:03:08.581000",
      "created": "2025-12-12T02:28:19.107000",
      "tags": [
        "compromised_site_redirector_fromcharcode",
        "site_redirector",
        "string",
        "regexp",
        "error",
        "number",
        "sxa0",
        "amptoken",
        "optout",
        "retrieving",
        "notfound",
        "write",
        "form",
        "flash",
        "vd",
        "tesla hackers",
        "nxdomain",
        "passive dns",
        "ip address",
        "domain",
        "a nxdomain",
        "urls",
        "files",
        "ip related",
        "pulses otx",
        "google",
        "unknown",
        "oracle",
        "dynamicloader",
        "medium",
        "high",
        "windows",
        "rndhex",
        "write c",
        "rndchar",
        "displayname",
        "tofsee",
        "yara rule",
        "stream",
        "strings",
        "push",
        "lte all",
        "search otx",
        "ource url",
        "or text",
        "paste",
        "data upload",
        "extraction",
        "elon musk",
        "indicator role",
        "active related",
        "ipv4",
        "exploitsource",
        "url https",
        "url http",
        "desktopinternet",
        "title added",
        "pulses ipv4",
        "less see",
        "ids detections",
        "vuze bt",
        "udp connection",
        "contacted",
        "filehash",
        "av detections",
        "yara detections",
        "alerts",
        "0x8aa42",
        "0xe3107",
        "upnp",
        "http request",
        "bittorrent",
        "file",
        "module load",
        "t1129",
        "post http",
        "install",
        "execution",
        "malware",
        "hostile",
        "crawl",
        "windows nt",
        "wow64",
        "get zona",
        "get httpget",
        "hash",
        "entries",
        "read c",
        "suspicious",
        "next",
        "united"
      ],
      "references": [
        "Tesla Hackers  | https://www.teslarati.com/spacex",
        "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
        "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
        "IDS Detections Win32/ZonaInstaller Install Beacon",
        "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
        "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
        "https://www.google-analytics.com/debug/bootstrap?id=\\",
        "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
        "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
        "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
        "This is why our team tells a back story. It can and does happen to anyone.",
        "We apologize for so may typos and errors. We strive to do better at that."
      ],
      "public": 1,
      "adversary": "Tesla Hackers",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Vd",
          "display_name": "Vd",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Win.Trojan.12382640-1",
          "display_name": "Win.Trojan.12382640-1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 65,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 2032,
        "URL": 4921,
        "domain": 567,
        "hostname": 1586,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "99 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "674ea53a3509f6554438cfb6",
      "name": "extrapolation from some ips in 2023 report",
      "description": "",
      "modified": "2025-06-02T19:58:17.107000",
      "created": "2024-12-03T06:29:14.674000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1131,
        "hostname": 2551,
        "domain": 1669,
        "URL": 6806,
        "CVE": 1
      },
      "indicator_count": 12158,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 184,
      "modified_text": "322 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d053a935bf99f5263deb57",
      "name": "History Killer Pro Injection deleting virustotal & otx.alienvault Pulses",
      "description": "History killer pro, is being used to delete and modify virustotal nodes and 41 otx.alienvault pulses. Junk data is being used to fill in missing pulses.\nTargeted: 1 callmeDoris  several scoreblue (sometimes I clone pulses) Octoseek.  \npulses.\nHallrender, Metro by T-Mobile, https://myaccount.uscis.gov/, Esurance,  40 pule reports are regarding Tsara Brashears cyber bully campaign which attacked the corporates mentioned except 2 AIG and Hallrender attackers. 100's of other modifications, deletions by another tool affecting several users.",
      "modified": "2024-03-18T04:01:27.756000",
      "created": "2024-02-17T06:35:21.666000",
      "tags": [
        "contacted",
        "execution",
        "january",
        "september",
        "whois record",
        "resolutions",
        "communicating",
        "roundup",
        "highly targeted",
        "phishing",
        "quasar",
        "malware",
        "open",
        "threat roundup",
        "referrer",
        "remote",
        "kimsuky",
        "passive dns",
        "urls",
        "dive domains",
        "creation date",
        "search",
        "record value",
        "date",
        "united",
        "scan endpoints",
        "all scoreblue",
        "unknown",
        "body",
        "brian sabey",
        "hall render",
        "reinsurance",
        "state",
        "danger",
        "threat",
        "critical",
        "crypthashdata",
        "read c",
        "tcmiheijkmutcix",
        "entries",
        "show",
        "t1055",
        "intel",
        "ms windows",
        "delphi",
        "win32",
        "copy",
        "write",
        "injection",
        "zusy",
        "neojit",
        "cyber stalking",
        "worker",
        "inject",
        "illegal",
        "tampering",
        "hijacker",
        "delete",
        "ret hat",
        "stalker",
        "shadow",
        "quasi"
      ],
      "references": [
        "www.historykillerpro.com",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "http://sniper.debugger.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Variant.Zusy.572 Checkin",
          "display_name": "Variant.Zusy.572 Checkin",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Neojit.A",
          "display_name": "TrojanDownloader:Win32/Neojit.A",
          "target": "/malware/TrojanDownloader:Win32/Neojit.A"
        },
        {
          "id": "Win32:Delf-SES\\ [Trj]",
          "display_name": "Win32:Delf-SES\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1372316",
          "display_name": "Win.Trojan.Agent-1372316",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1915,
        "FileHash-MD5": 437,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 3054,
        "domain": 987,
        "URL": 5902,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 12732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "763 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d0a9c7f1b04296d9b0d803",
      "name": "History Killer Pro Injection deleting VirusTotal & OTX.AlienVault Pulses",
      "description": "",
      "modified": "2024-03-18T04:01:27.756000",
      "created": "2024-02-17T12:42:47.334000",
      "tags": [
        "contacted",
        "execution",
        "january",
        "september",
        "whois record",
        "resolutions",
        "communicating",
        "roundup",
        "highly targeted",
        "phishing",
        "quasar",
        "malware",
        "open",
        "threat roundup",
        "referrer",
        "remote",
        "kimsuky",
        "passive dns",
        "urls",
        "dive domains",
        "creation date",
        "search",
        "record value",
        "date",
        "united",
        "scan endpoints",
        "all scoreblue",
        "unknown",
        "body",
        "brian sabey",
        "hall render",
        "reinsurance",
        "state",
        "danger",
        "threat",
        "critical",
        "crypthashdata",
        "read c",
        "tcmiheijkmutcix",
        "entries",
        "show",
        "t1055",
        "intel",
        "ms windows",
        "delphi",
        "win32",
        "copy",
        "write",
        "injection",
        "zusy",
        "neojit",
        "cyber stalking",
        "worker",
        "inject",
        "illegal",
        "tampering",
        "hijacker",
        "delete",
        "ret hat",
        "stalker",
        "shadow",
        "quasi"
      ],
      "references": [
        "www.historykillerpro.com",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "http://sniper.debugger.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Variant.Zusy.572 Checkin",
          "display_name": "Variant.Zusy.572 Checkin",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Neojit.A",
          "display_name": "TrojanDownloader:Win32/Neojit.A",
          "target": "/malware/TrojanDownloader:Win32/Neojit.A"
        },
        {
          "id": "Win32:Delf-SES\\ [Trj]",
          "display_name": "Win32:Delf-SES\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1372316",
          "display_name": "Win.Trojan.Agent-1372316",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65d053a935bf99f5263deb57",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1915,
        "FileHash-MD5": 437,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 3054,
        "domain": 987,
        "URL": 5902,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 12732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "763 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb4768b06f4da2fba5959b",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:44.270000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "767 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb476d0566c2d07e474df5",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:49.140000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "767 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb476d935dd560b4a3e938",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:49.380000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "767 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cb4772c3d3ad1f7accc98a",
      "name": "Ryuk Ransomware - workers.dev | https://house.mo.gov",
      "description": "Ryuk is ransomware version attributed to the hacker group WIZARD SPIDER that has compromised governments, academia, healthcare, manufacturing, and technology organizations.\n\nInterestingly, this ransomware family carries a Japanese name from the anime movie Death Note. The name means \u201cgift of god.\u201d It seems an odd choice for ransomware since the targets lose data or money. From the hacker's perspective, however, it could be considered a gift of god.",
      "modified": "2024-03-14T09:04:37.097000",
      "created": "2024-02-13T10:41:53.179000",
      "tags": [
        "contacted",
        "ssl certificate",
        "contacted urls",
        "whois record",
        "whois whois",
        "relacionada",
        "execution",
        "p2404",
        "kgs0",
        "kls0",
        "lockbit",
        "lolkek",
        "emotet",
        "phishing",
        "ursnif",
        "malware",
        "core",
        "ryuk ransomware",
        "qakbot",
        "makop",
        "hacktool",
        "chaos",
        "ransomexx",
        "temp",
        "localappdata",
        "pattern match",
        "ascii text",
        "json data",
        "united",
        "indicator",
        "prefetch8",
        "observed email",
        "unicode text",
        "date",
        "hybrid",
        "win64",
        "general",
        "click",
        "strings",
        "tsara brashears",
        "suspicious",
        "falcon",
        "name verdict",
        "reinsurance",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as13335",
        "title",
        "gmt server",
        "user agent",
        "443 ma2592000",
        "hostname",
        "encrypt",
        "script urls",
        "t matrix",
        "dch v",
        "meta",
        "trang ch",
        "body",
        "status",
        "search",
        "creation date",
        "record value",
        "domain name",
        "litespeed",
        "certificate",
        "speed",
        "next",
        "unknown",
        "ipv4",
        "reverse dns",
        "name servers",
        "expiration date",
        "showing",
        "pulse submit",
        "gandi sas",
        "moved",
        "emails",
        "servers",
        "error",
        "russia unknown",
        "as31483",
        "as12768",
        "as30943",
        "united kingdom",
        "as208722 yandex",
        "cname",
        "spyware",
        "tracking",
        "login"
      ],
      "references": [
        "workers.dev [extraction \u2022 GET request attack]",
        "ddos.dnsnb8.net [command_and_control]",
        "www.supernetforme.com  [command_and_control]",
        "https://www.trendmicro.com/en_us/what-is/ransomware/ryuk-ransomware.html",
        "http://www.supernetforme.com/search.php?q=2075.2075.300.4096.0.756ae987de3398fb3871e5916bf6fa3ea748bb384f297c252a6a6c52397bb6be.1.399198437 [phishing \u2022 python]",
        "https://www.milehighmedia.com/legal/2257 [Brazzers Porn Virus Network \u2022 Data collection \u2022 phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 virus network \u2022 Apple data collection ]",
        "CVE: CVE-2023-23397",
        "0-129-112027imap-intranet-pv-175-166.matomo.cloud",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption \u2022 unlocker]",
        "https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://twitter.com/PORNO_SEXYBABES",
        "sex-ukraine.net",
        "http://ww38.hardsexxxtube.com/scj/thumbs/295/196_teen_Megan.jpg \u2022\t humani-teens.com",
        "feedercontroller.webcrawlingeap-prod-co4.binginternal.com",
        "accessoire-telephones.fr \u2022 bks-tv.ru [telecom] \u2022 coltel.ru  [telecom] \u2022 ceptelefondata.com.tr [data collection \u2022 USA] ts-astra.ru  [telecom] wifi.ru",
        "nexus.b2btest.ertelecom.ru",
        "Virus Network: 192.229.211.108 | Tracking: http://d1ql3z8u1oo390.cloudfront.net/offer.php?affId=7512&trackingId=433313787&instId=7584&ho_trackingid=HO433313787&cc=DE&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=bcbaa53dffa0965e557319f4f2155088&v=3&net=4.8.03761&ie=8.0.7601.17514&res=800x600&osd=151&kid=hqmrb21boa4c9c32d7k",
        "Tracking: trackyouremails.com \u2022 https://adservice.google.com.uy/clk",
        "http://micrologin.ogspy.net/track/dhl-information-contact.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Ryuk Ransomware",
          "display_name": "Ryuk Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 127,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 4862,
        "hostname": 3571,
        "URL": 10597,
        "CVE": 3,
        "domain": 3169,
        "email": 7
      },
      "indicator_count": 22461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "767 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "778 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b93e70b75e7dce7168f4dd",
      "name": "Google - Lumma Stealer| QakBot | Emotet",
      "description": "Lumma is classified as a stealer - a type of malware that extracts sensitive information from infected devices.\n\nYou can't see it. You will see https://www.google.com and your search. It's hidden spyware. extremely malicious. Targeted individual.",
      "modified": "2024-02-29T17:01:09.717000",
      "created": "2024-01-30T18:22:40.905000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "historical ssl",
        "referrer",
        "urls url",
        "whois whois",
        "october",
        "resolutions",
        "august",
        "execution",
        "installer",
        "iframe",
        "malware",
        "core",
        "emotet",
        "lumma stealer",
        "ransomexx",
        "azorult",
        "ursnif",
        "hacktool",
        "june",
        "qakbot",
        "qbot",
        "april",
        "targeting",
        "tsara brashears",
        "active threat"
      ],
      "references": [
        "google.com.uy [Google search browser, masked, links to malicious porn malware spreader, malvertizing, collection host]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password cracker]",
        "toolbarqueries.google.com.uy"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Azorult",
          "display_name": "Azorult",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "Qbot",
          "display_name": "Qbot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "T1030",
          "name": "Data Transfer Size Limits",
          "display_name": "T1030 - Data Transfer Size Limits"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 50,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 3377,
        "hostname": 2502,
        "URL": 8531,
        "domain": 1250,
        "CVE": 2
      },
      "indicator_count": 15758,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ww25.odapps.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ww25.odapps.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776727913.400962
}