{
  "type": "URL",
  "indicator": "https://www.getinge.com.tw",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.getinge.com.tw",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4156689746,
      "indicator": "https://www.getinge.com.tw",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "69ca31b28c2fa3e734bf5000",
          "name": "instagram staged credit clone a vashti :(",
          "description": "",
          "modified": "2026-03-31T12:16:21.521000",
          "created": "2026-03-30T08:17:54.205000",
          "tags": [
            "dynamicloader",
            "port",
            "destination",
            "yara rule",
            "high",
            "tofsee",
            "rndhex",
            "rndchar",
            "loaderid",
            "write",
            "stream",
            "malware",
            "systemroot",
            "write c",
            "displayname",
            "windows",
            "trojan",
            "defender",
            "unknown",
            "less see",
            "all ip",
            "contacted",
            "less related",
            "meta",
            "emotet",
            "backdoor",
            "packer",
            "many",
            "hall render",
            "brian sabey",
            "christopher p. ahmann",
            "state of colorado",
            "google",
            "yahoo",
            "microsoft",
            "stealth window",
            "reads_self",
            "injection write process",
            "remote",
            "remote process",
            "dynamic function loading",
            "compromises device",
            "dead connect",
            "dynamic loader",
            "command",
            "cnc",
            "sleep sandbox",
            "iocontrol",
            "behavior tofsee",
            "suspicious code",
            "injection",
            "persistence",
            "rootkit",
            "social media",
            "belgium belgium",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "pattern match",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "network traffic",
            "t1071",
            "spawns",
            "html content",
            "href",
            "general",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "defense evasion",
            "development att",
            "tracking"
          ],
          "references": [
            "Instagram.com",
            "IDS Detections: tofsee",
            "Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
            "Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
            "Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
            "IP\u2019s Contacted: 94.100.180.31  142.251.9.27  98.136.96.91  43.231.4.7  52.101.8.42",
            "Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
            "Brian Sabey , Christopher P. Ahmann , State of Colorado who",
            "http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
            "Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Emotet.YL",
              "display_name": "Trojan:Win32/Emotet.YL",
              "target": "/malware/Trojan:Win32/Emotet.YL"
            },
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1589",
              "name": "Gather Victim Identity Information",
              "display_name": "T1589 - Gather Victim Identity Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1592",
              "name": "Gather Victim Host Information",
              "display_name": "T1592 - Gather Victim Host Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6949b6d8180bca3df9783578",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 911,
            "domain": 178,
            "hostname": 206,
            "FileHash-SHA256": 647,
            "FileHash-MD5": 38,
            "FileHash-SHA1": 28
          },
          "indicator_count": 2008,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693cdc5b8ebc10664439c2fb",
          "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - Freeman Mathis & Gary for The State of Colorado",
          "description": "State of Colorado attackers use  DGA domains set up multiple Law Firms.. Christopher P.  \u2019Buzz\u2019  Ahmann  Is a legal consultant / attorney./ hacker \nWorks for the State of Colorado/ quasi. Is malicious and doesn\u2019t work alone. Continues to target \nState had relative contacted by a fake entity \u2018Goodness Health\u2019\nLeft vague VM for relative message \u201cWe work on the Medicare side of things.\u201d and? \nSocial engineering call , malicious domain. The State of Colorado has been on a relentless pursuit against target. Fully compromised targets relatives brand new phone. Hacked target since 10/2013.\nMultiple cyber and physical attacks carried out  against target and family members.. There are attacks make  to look like accidents or malfunctions. This harmful, silencing behavior is somehow illegal for anyone else.",
          "modified": "2026-02-10T06:05:39.764000",
          "created": "2025-12-13T03:24:11.414000",
          "tags": [
            "colorado state",
            "freeman mathis",
            "history",
            "cyber risk",
            "aspen insureds",
            "gaig insureds",
            "landy insureds",
            "nip group",
            "purm insureds",
            "overview core",
            "united",
            "ip address",
            "present nov",
            "present may",
            "moved",
            "encrypt",
            "unknown",
            "backdoor",
            "passive dns",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "twitter",
            "trojan",
            "data upload",
            "extraction",
            "failed",
            "united states",
            "server response",
            "google safe",
            "results may",
            "lowfi",
            "virtool",
            "mtb alf",
            "mh alf",
            "port",
            "windows nt",
            "destination",
            "msie",
            "khtml",
            "gecko",
            "unknown aaaa",
            "a domains",
            "meta",
            "for privacy",
            "cop supply",
            "urls",
            "as139646 hong",
            "hostname",
            "files",
            "hong kong",
            "domain add",
            "ip related",
            "hash avast",
            "avg clamav",
            "msdefender may",
            "ddos",
            "as13335",
            "ipv4",
            "certificate",
            "hostname add",
            "url analysis",
            "files ip",
            "name strings",
            "category",
            "united states",
            "pulse indicator",
            "address",
            "error",
            "null",
            "object",
            "string",
            "number",
            "google maps",
            "promise",
            "javascript api",
            "dataset",
            "bigint",
            "dark",
            "android",
            "infinity",
            "internal",
            "roboto",
            "trident",
            "void",
            "small",
            "lightrail",
            "false",
            "span",
            "close",
            "light",
            "hybrid",
            "embed",
            "iframe",
            "keygen",
            "this",
            "february",
            "bounce",
            "drop",
            "inside",
            "outside",
            "marker",
            "present dec",
            "pulses otx",
            "aaaa",
            "asnone country",
            "record value",
            "title",
            "pulse pulses",
            "pulses",
            "showing",
            "unknown cname",
            "unknown soa",
            "next associated",
            "ipv4 add",
            "cycbot",
            "extract indic",
            "sneaker bots",
            "proxies data",
            "script script",
            "adult content",
            "nextimage",
            "porn site",
            "div div",
            "platform make",
            "cloudfront x",
            "hio52 p3",
            "unknown ns",
            "pulse submit",
            "title error",
            "reverse dns",
            "status",
            "servers",
            "name servers",
            "vashti hostname",
            "scan endpoints",
            "url http",
            "http",
            "files domain",
            "files related",
            "pulses none",
            "dnssec",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "version list",
            "domain",
            "emails",
            "cookie",
            "url https",
            "show",
            "filehash",
            "urls show",
            "date checked",
            "url hostname",
            "results nov",
            "win32",
            "type",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "llc name",
            "server",
            "markmonitor",
            "name server",
            "windir",
            "openurl c",
            "prefetch2",
            "show technique",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "sha1",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "germany unknown",
            "date",
            "registrar",
            "ip whois",
            "dynamicloader",
            "high",
            "medium",
            "search",
            "displayname",
            "tofsee",
            "win64",
            "write",
            "stream",
            "malware",
            "push",
            "entries",
            "tls handshake",
            "failure",
            "forbidden",
            "tlsv1",
            "april",
            "next",
            "write c",
            "intel",
            "ms windows",
            "sha1 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "sha256 add",
            "present jun",
            "present mar",
            "medelln",
            "colombia asn",
            "dns resolutions",
            "address domain",
            "related tags",
            "none google",
            "safe browsing",
            "external",
            "present sep",
            "present aug",
            "as54113",
            "present jul",
            "as8068",
            "gmt content",
            "total",
            "read",
            "delete",
            "top source",
            "quasi",
            "murderers",
            "christopher ahmann",
            "buzz ahmann",
            "wow64",
            "slcc2",
            "media center",
            "labor",
            "employment",
            "cdle",
            "dowc",
            "colorado",
            "workers",
            "coloradoif",
            "independent",
            "state",
            "company",
            "entity type",
            "authorized line",
            "analysis",
            "tor analysis",
            "process details",
            "network traffic",
            "t1071",
            "potential ip",
            "click",
            "found",
            "t1480 execution",
            "bad traffic",
            "et info",
            "ck techniques",
            "evasion att",
            "t1057",
            "refresh",
            "body",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "cname",
            "form",
            "pulse",
            "script domains",
            "script urls",
            "administrator",
            "services llc",
            "dns admin",
            "domain admin",
            "global llc",
            "domain manager",
            "computer system",
            "ltd domain",
            "network",
            "alibaba",
            "facebook",
            "phishme",
            "sogou",
            "present jan",
            "present feb",
            "present oct"
          ],
          "references": [
            "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
            "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
            "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
            "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
            "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
            "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
            "https://maps.googleapis.com/maps/api/js?sensor=false",
            "cell-0.af-south-1.prod.telemetry.console.api.aws",
            "howtoworkacrickoutofyourneck2.pages.dev",
            "firebase-auth-eich0v.pages.dev",
            "http://ianswertomom.com/develop-wise-woman-within-yourself",
            "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
            "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
            "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
            "https://khmerpornvideo.signup0.y.id/",
            "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
            "https://clear.ml/infrastructure-control-plane",
            "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
            "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
            "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
            "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
            "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
            "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
            "Legal court documented  agreement to allow and pay target to hire cyber investigators",
            "Attacks are being carried out by The State of Colorado"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "France",
            "Ireland",
            "Spain",
            "Italy",
            "Aruba",
            "Australia",
            "Denmark",
            "United Kingdom of Great Britain and Northern Ireland",
            "Germany",
            "T\u00fcrkiye",
            "Indonesia"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.GravityRAT-6511862-0",
              "display_name": "Win.Trojan.GravityRAT-6511862-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Unix.Trojan.Tsunami-6981155-0",
              "display_name": "Unix.Trojan.Tsunami-6981155-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Systex.A",
              "display_name": "TrojanDropper:Win32/Systex.A",
              "target": "/malware/TrojanDropper:Win32/Systex.A"
            },
            {
              "id": "Win.Trojan.Tepfer-61",
              "display_name": "Win.Trojan.Tepfer-61",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "target": null
            },
            {
              "id": "VirTool:Win32/VBInject.gen!MH",
              "display_name": "VirTool:Win32/VBInject.gen!MH",
              "target": "/malware/VirTool:Win32/VBInject.gen!MH"
            },
            {
              "id": "ALF:NID:Susp_NSIS_Stub.A",
              "display_name": "ALF:NID:Susp_NSIS_Stub.A",
              "target": null
            },
            {
              "id": "#LOWFI:HSTR:Criakl.B1",
              "display_name": "#LOWFI:HSTR:Criakl.B1",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Arwobot.B",
              "display_name": "Backdoor:Win32/Arwobot.B",
              "target": "/malware/Backdoor:Win32/Arwobot.B"
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "Win.Downloader.Small-4507",
              "display_name": "Win.Downloader.Small-4507",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qbot.R!MTB",
              "display_name": "Trojan:Win32/Qbot.R!MTB",
              "target": "/malware/Trojan:Win32/Qbot.R!MTB"
            },
            {
              "id": "Win.Malware.Mikey-9949492-0",
              "display_name": "Win.Malware.Mikey-9949492-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Backdoor:Linux/DemonBot.Aa!MTB",
              "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
              "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
            },
            {
              "id": "Unix.Trojan.Gafgyt-6981154-0",
              "display_name": "Unix.Trojan.Gafgyt-6981154-0",
              "target": null
            },
            {
              "id": "DDOS:Linux/Gafgyt.YA!MTB",
              "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "CVE-2017-11882",
              "display_name": "CVE-2017-11882",
              "target": null
            },
            {
              "id": "ALF:Exploit:O97M/CVE-2017-8977",
              "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
              "target": null
            },
            {
              "id": "Cycbot",
              "display_name": "Cycbot",
              "target": null
            },
            {
              "id": "Win32:BotX-gen\\ [Trj]",
              "display_name": "Win32:BotX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            },
            {
              "id": "Mirai (ELF)",
              "display_name": "Mirai (ELF)",
              "target": null
            },
            {
              "id": "Worm",
              "display_name": "Worm",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            }
          ],
          "industries": [
            "Insurance",
            "Construction"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 54118,
            "domain": 11153,
            "hostname": 18578,
            "email": 21,
            "FileHash-SHA256": 4905,
            "FileHash-MD5": 548,
            "FileHash-SHA1": 534,
            "CVE": 7,
            "SSLCertFingerprint": 20,
            "CIDR": 1
          },
          "indicator_count": 89885,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "68 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6963596c4cd594b77b4675ec",
          "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - PalantirFoundry | The State of Colorado | ",
          "description": "",
          "modified": "2026-02-10T06:05:39.764000",
          "created": "2026-01-11T08:03:56.534000",
          "tags": [
            "colorado state",
            "freeman mathis",
            "history",
            "cyber risk",
            "aspen insureds",
            "gaig insureds",
            "landy insureds",
            "nip group",
            "purm insureds",
            "overview core",
            "united",
            "ip address",
            "present nov",
            "present may",
            "moved",
            "encrypt",
            "unknown",
            "backdoor",
            "passive dns",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "twitter",
            "trojan",
            "data upload",
            "extraction",
            "failed",
            "united states",
            "server response",
            "google safe",
            "results may",
            "lowfi",
            "virtool",
            "mtb alf",
            "mh alf",
            "port",
            "windows nt",
            "destination",
            "msie",
            "khtml",
            "gecko",
            "unknown aaaa",
            "a domains",
            "meta",
            "for privacy",
            "cop supply",
            "urls",
            "as139646 hong",
            "hostname",
            "files",
            "hong kong",
            "domain add",
            "ip related",
            "hash avast",
            "avg clamav",
            "msdefender may",
            "ddos",
            "as13335",
            "ipv4",
            "certificate",
            "hostname add",
            "url analysis",
            "files ip",
            "name strings",
            "category",
            "united states",
            "pulse indicator",
            "address",
            "error",
            "null",
            "object",
            "string",
            "number",
            "google maps",
            "promise",
            "javascript api",
            "dataset",
            "bigint",
            "dark",
            "android",
            "infinity",
            "internal",
            "roboto",
            "trident",
            "void",
            "small",
            "lightrail",
            "false",
            "span",
            "close",
            "light",
            "hybrid",
            "embed",
            "iframe",
            "keygen",
            "this",
            "february",
            "bounce",
            "drop",
            "inside",
            "outside",
            "marker",
            "present dec",
            "pulses otx",
            "aaaa",
            "asnone country",
            "record value",
            "title",
            "pulse pulses",
            "pulses",
            "showing",
            "unknown cname",
            "unknown soa",
            "next associated",
            "ipv4 add",
            "cycbot",
            "extract indic",
            "sneaker bots",
            "proxies data",
            "script script",
            "adult content",
            "nextimage",
            "porn site",
            "div div",
            "platform make",
            "cloudfront x",
            "hio52 p3",
            "unknown ns",
            "pulse submit",
            "title error",
            "reverse dns",
            "status",
            "servers",
            "name servers",
            "vashti hostname",
            "scan endpoints",
            "url http",
            "http",
            "files domain",
            "files related",
            "pulses none",
            "dnssec",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "version list",
            "domain",
            "emails",
            "cookie",
            "url https",
            "show",
            "filehash",
            "urls show",
            "date checked",
            "url hostname",
            "results nov",
            "win32",
            "type",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "llc name",
            "server",
            "markmonitor",
            "name server",
            "windir",
            "openurl c",
            "prefetch2",
            "show technique",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "sha1",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "germany unknown",
            "date",
            "registrar",
            "ip whois",
            "dynamicloader",
            "high",
            "medium",
            "search",
            "displayname",
            "tofsee",
            "win64",
            "write",
            "stream",
            "malware",
            "push",
            "entries",
            "tls handshake",
            "failure",
            "forbidden",
            "tlsv1",
            "april",
            "next",
            "write c",
            "intel",
            "ms windows",
            "sha1 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "sha256 add",
            "present jun",
            "present mar",
            "medelln",
            "colombia asn",
            "dns resolutions",
            "address domain",
            "related tags",
            "none google",
            "safe browsing",
            "external",
            "present sep",
            "present aug",
            "as54113",
            "present jul",
            "as8068",
            "gmt content",
            "total",
            "read",
            "delete",
            "top source",
            "quasi",
            "murderers",
            "christopher ahmann",
            "buzz ahmann",
            "wow64",
            "slcc2",
            "media center",
            "labor",
            "employment",
            "cdle",
            "dowc",
            "colorado",
            "workers",
            "coloradoif",
            "independent",
            "state",
            "company",
            "entity type",
            "authorized line",
            "analysis",
            "tor analysis",
            "process details",
            "network traffic",
            "t1071",
            "potential ip",
            "click",
            "found",
            "t1480 execution",
            "bad traffic",
            "et info",
            "ck techniques",
            "evasion att",
            "t1057",
            "refresh",
            "body",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "cname",
            "form",
            "pulse",
            "script domains",
            "script urls",
            "administrator",
            "services llc",
            "dns admin",
            "domain admin",
            "global llc",
            "domain manager",
            "computer system",
            "ltd domain",
            "network",
            "alibaba",
            "facebook",
            "phishme",
            "sogou",
            "present jan",
            "present feb",
            "present oct"
          ],
          "references": [
            "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
            "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
            "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
            "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
            "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
            "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
            "https://maps.googleapis.com/maps/api/js?sensor=false",
            "cell-0.af-south-1.prod.telemetry.console.api.aws",
            "howtoworkacrickoutofyourneck2.pages.dev",
            "firebase-auth-eich0v.pages.dev",
            "http://ianswertomom.com/develop-wise-woman-within-yourself",
            "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
            "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
            "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
            "https://khmerpornvideo.signup0.y.id/",
            "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
            "https://clear.ml/infrastructure-control-plane",
            "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
            "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
            "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
            "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
            "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
            "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
            "Legal court documented  agreement to allow and pay target to hire cyber investigators",
            "Attacks are being carried out by The State of Colorado"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "France",
            "Ireland",
            "Spain",
            "Italy",
            "Aruba",
            "Australia",
            "Denmark",
            "United Kingdom of Great Britain and Northern Ireland",
            "Germany",
            "T\u00fcrkiye",
            "Indonesia"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.GravityRAT-6511862-0",
              "display_name": "Win.Trojan.GravityRAT-6511862-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
              "target": null
            },
            {
              "id": "Unix.Trojan.Tsunami-6981155-0",
              "display_name": "Unix.Trojan.Tsunami-6981155-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Systex.A",
              "display_name": "TrojanDropper:Win32/Systex.A",
              "target": "/malware/TrojanDropper:Win32/Systex.A"
            },
            {
              "id": "Win.Trojan.Tepfer-61",
              "display_name": "Win.Trojan.Tepfer-61",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
              "target": null
            },
            {
              "id": "VirTool:Win32/VBInject.gen!MH",
              "display_name": "VirTool:Win32/VBInject.gen!MH",
              "target": "/malware/VirTool:Win32/VBInject.gen!MH"
            },
            {
              "id": "ALF:NID:Susp_NSIS_Stub.A",
              "display_name": "ALF:NID:Susp_NSIS_Stub.A",
              "target": null
            },
            {
              "id": "#LOWFI:HSTR:Criakl.B1",
              "display_name": "#LOWFI:HSTR:Criakl.B1",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Arwobot.B",
              "display_name": "Backdoor:Win32/Arwobot.B",
              "target": "/malware/Backdoor:Win32/Arwobot.B"
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "Win.Downloader.Small-4507",
              "display_name": "Win.Downloader.Small-4507",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qbot.R!MTB",
              "display_name": "Trojan:Win32/Qbot.R!MTB",
              "target": "/malware/Trojan:Win32/Qbot.R!MTB"
            },
            {
              "id": "Win.Malware.Mikey-9949492-0",
              "display_name": "Win.Malware.Mikey-9949492-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Backdoor:Linux/DemonBot.Aa!MTB",
              "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
              "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
            },
            {
              "id": "Unix.Trojan.Gafgyt-6981154-0",
              "display_name": "Unix.Trojan.Gafgyt-6981154-0",
              "target": null
            },
            {
              "id": "DDOS:Linux/Gafgyt.YA!MTB",
              "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "CVE-2017-11882",
              "display_name": "CVE-2017-11882",
              "target": null
            },
            {
              "id": "ALF:Exploit:O97M/CVE-2017-8977",
              "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
              "target": null
            },
            {
              "id": "Cycbot",
              "display_name": "Cycbot",
              "target": null
            },
            {
              "id": "Win32:BotX-gen\\ [Trj]",
              "display_name": "Win32:BotX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            },
            {
              "id": "Mirai (ELF)",
              "display_name": "Mirai (ELF)",
              "target": null
            },
            {
              "id": "Worm",
              "display_name": "Worm",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1204.001",
              "name": "Malicious Link",
              "display_name": "T1204.001 - Malicious Link"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            }
          ],
          "industries": [
            "Insurance",
            "Construction"
          ],
          "TLP": "green",
          "cloned_from": "693cdc5b8ebc10664439c2fb",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 54118,
            "domain": 11153,
            "hostname": 18578,
            "email": 21,
            "FileHash-SHA256": 4905,
            "FileHash-MD5": 548,
            "FileHash-SHA1": 534,
            "CVE": 7,
            "SSLCertFingerprint": 20,
            "CIDR": 1
          },
          "indicator_count": 89885,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "68 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6949b6d8180bca3df9783578",
          "name": "Instagram (staged) Emotet & Tofsee Backdoor",
          "description": "If you choose to read this, I apologize for the riddle.Pegasus like tracking operation.\nAdversarial attack on a private citizens or (possibly staged instagram account). The citizen is not a known target. Attacks appear to arise from same internet criminals, allegedly State of Colorado employees engaged in permissible criminal behavior. Account does belongs to a person in sphere of a known monitored target. Target naturally has no communication with account holder. Known target had been invited to be Facebook friends of infected account holder multiple times, both target and associate declined and blocked this infected account holder. |\n\n* Infected Instagram account holders husband referred target to a Colorado Law Firm. The Law firm was attacked some time ago. | \n***Infected instagram account holder name is  redacted. Is being tracked :(",
          "modified": "2026-01-21T20:01:56.174000",
          "created": "2025-12-22T21:23:36.083000",
          "tags": [
            "dynamicloader",
            "port",
            "destination",
            "yara rule",
            "high",
            "tofsee",
            "rndhex",
            "rndchar",
            "loaderid",
            "write",
            "stream",
            "malware",
            "systemroot",
            "write c",
            "displayname",
            "windows",
            "trojan",
            "defender",
            "unknown",
            "less see",
            "all ip",
            "contacted",
            "less related",
            "meta",
            "emotet",
            "backdoor",
            "packer",
            "many",
            "hall render",
            "brian sabey",
            "christopher p. ahmann",
            "state of colorado",
            "google",
            "yahoo",
            "microsoft",
            "stealth window",
            "reads_self",
            "injection write process",
            "remote",
            "remote process",
            "dynamic function loading",
            "compromises device",
            "dead connect",
            "dynamic loader",
            "command",
            "cnc",
            "sleep sandbox",
            "iocontrol",
            "behavior tofsee",
            "suspicious code",
            "injection",
            "persistence",
            "rootkit",
            "social media",
            "belgium belgium",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "pattern match",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "network traffic",
            "t1071",
            "spawns",
            "html content",
            "href",
            "general",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "defense evasion",
            "development att",
            "tracking"
          ],
          "references": [
            "Instagram.com",
            "IDS Detections: tofsee",
            "Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
            "Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
            "Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
            "IP\u2019s Contacted: 94.100.180.31  142.251.9.27  98.136.96.91  43.231.4.7  52.101.8.42",
            "Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
            "Brian Sabey , Christopher P. Ahmann , State of Colorado who",
            "http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
            "Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Emotet.YL",
              "display_name": "Trojan:Win32/Emotet.YL",
              "target": "/malware/Trojan:Win32/Emotet.YL"
            },
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1589",
              "name": "Gather Victim Identity Information",
              "display_name": "T1589 - Gather Victim Identity Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1592",
              "name": "Gather Victim Host Information",
              "display_name": "T1592 - Gather Victim Host Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 910,
            "domain": 177,
            "hostname": 206,
            "FileHash-SHA256": 647,
            "FileHash-MD5": 38,
            "FileHash-SHA1": 28
          },
          "indicator_count": 2006,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "88 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693de4a8a72cf95b028365f0",
          "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee",
          "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets",
          "modified": "2026-01-12T21:02:35.560000",
          "created": "2025-12-13T22:11:52.474000",
          "tags": [
            "network",
            "ip address",
            "subnet",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "windows",
            "united",
            "write",
            "tofsee",
            "stream",
            "win64",
            "push",
            "urls",
            "url analysis",
            "dnssec",
            "script domains",
            "encrypt",
            "url add",
            "http",
            "related nids",
            "flag united",
            "germany",
            "address google",
            "passive dns",
            "ipv4 add",
            "files",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "location united",
            "asn asnone",
            "present dec",
            "backdoor",
            "lowfi",
            "win32autoit mar",
            "urls show",
            "date checked",
            "connection",
            "httponly",
            "secure",
            "path",
            "expiressat",
            "dynamic cfray",
            "medium",
            "delete c",
            "displayname",
            "show",
            "unknown",
            "next",
            "rndhex",
            "malware",
            "cname",
            "next associated",
            "url hostname",
            "server response",
            "google safe",
            "read c",
            "unicode",
            "png image",
            "rgba",
            "memcommit",
            "dock",
            "execution",
            "files location",
            "china flag",
            "china hostname",
            "hostname",
            "domain",
            "files ip",
            "address",
            "asn as45102",
            "gmt content",
            "certificate",
            "associated urls",
            "location china",
            "china asn",
            "as4808 china",
            "present aug",
            "object",
            "present apr",
            "present oct",
            "alman",
            "present sep",
            "error",
            "present jul",
            "rmndrp",
            "present feb",
            "expiration",
            "url https",
            "url http",
            "iocs",
            "review iocs",
            "expireswed",
            "samesitenone",
            "maxage86400",
            "maxage0",
            "server",
            "expires",
            "victina nulcac",
            "data upload",
            "extraction",
            "enter",
            "enter source",
            "url data",
            "type",
            "extract indic",
            "included iocs",
            "china unknown",
            "botnet",
            "folk in browser",
            "japan unknown",
            "asnone country",
            "as13335",
            "a domains",
            "script urls",
            "servers",
            "title",
            "moved",
            "record value",
            "entries",
            "whitelisted",
            "powershell",
            "xf9xb5xf9",
            "xxcexf6x8fr",
            "k2xe7xcbxxeaxa2",
            "x99x19",
            "x88yxf9xc858",
            "x83x12x8da",
            "zx9bx8ex84",
            "attempts",
            "yara detections",
            "contacted",
            "tags none",
            "file type",
            "pe packer",
            "dll compilation",
            "guard",
            "botnets"
          ],
          "references": [
            "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
            "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
            "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
            "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
            "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America",
            "Russian Federation",
            "T\u00fcrkiye",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Win32/Tofsee",
              "display_name": "Backdoor:Win32/Tofsee",
              "target": "/malware/Backdoor:Win32/Tofsee"
            },
            {
              "id": "AutoIT",
              "display_name": "AutoIT",
              "target": null
            },
            {
              "id": "HtBot",
              "display_name": "HtBot",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1195.001",
              "name": "Compromise Software Dependencies and Development Tools",
              "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1481",
              "name": "Web Service",
              "display_name": "T1481 - Web Service"
            },
            {
              "id": "T1534",
              "name": "Internal Spearphishing",
              "display_name": "T1534 - Internal Spearphishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8145,
            "domain": 1389,
            "FileHash-SHA256": 1545,
            "CIDR": 2,
            "hostname": 2533,
            "FileHash-MD5": 209,
            "FileHash-SHA1": 190,
            "email": 6,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 14023,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "97 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "693b7dc3cf1996347652ef92",
          "name": "Google Site Redirector - Tesla Hackers",
          "description": "Silencing. By Tesla hackers. Awful example of how any victim of a crime; can become a target of the government..\nThis is especially true when the actual perpetrators work for the government are government affiliated, very wealthy, a celebrity or someone who is deemed important. In this instance the Quasi government sought to keep target seeking and obtaining life saving medical treatment, financial settlement that she was entitled to from assault, injuries from assault, false imprisonment, punitive damgages, pain and suffering, humiliation, premise liability, permanent (whole body disability @MMI ), many other crimes. The victims suffered from a great sadness and betrayal. \n\nObviously racist Elon Musk and crew have access to all government tools. Musk, All things cyber are at his disposal as \ncontinues to abuse privilege.\n They keep  playing a God  they  don\u2019t believe in. God is the Ultimate Avenger.",
          "modified": "2026-01-11T00:03:08.581000",
          "created": "2025-12-12T02:28:19.107000",
          "tags": [
            "compromised_site_redirector_fromcharcode",
            "site_redirector",
            "string",
            "regexp",
            "error",
            "number",
            "sxa0",
            "amptoken",
            "optout",
            "retrieving",
            "notfound",
            "write",
            "form",
            "flash",
            "vd",
            "tesla hackers",
            "nxdomain",
            "passive dns",
            "ip address",
            "domain",
            "a nxdomain",
            "urls",
            "files",
            "ip related",
            "pulses otx",
            "google",
            "unknown",
            "oracle",
            "dynamicloader",
            "medium",
            "high",
            "windows",
            "rndhex",
            "write c",
            "rndchar",
            "displayname",
            "tofsee",
            "yara rule",
            "stream",
            "strings",
            "push",
            "lte all",
            "search otx",
            "ource url",
            "or text",
            "paste",
            "data upload",
            "extraction",
            "elon musk",
            "indicator role",
            "active related",
            "ipv4",
            "exploitsource",
            "url https",
            "url http",
            "desktopinternet",
            "title added",
            "pulses ipv4",
            "less see",
            "ids detections",
            "vuze bt",
            "udp connection",
            "contacted",
            "filehash",
            "av detections",
            "yara detections",
            "alerts",
            "0x8aa42",
            "0xe3107",
            "upnp",
            "http request",
            "bittorrent",
            "file",
            "module load",
            "t1129",
            "post http",
            "install",
            "execution",
            "malware",
            "hostile",
            "crawl",
            "windows nt",
            "wow64",
            "get zona",
            "get httpget",
            "hash",
            "entries",
            "read c",
            "suspicious",
            "next",
            "united"
          ],
          "references": [
            "Tesla Hackers  | https://www.teslarati.com/spacex",
            "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
            "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
            "IDS Detections Win32/ZonaInstaller Install Beacon",
            "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
            "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
            "https://www.google-analytics.com/debug/bootstrap?id=\\",
            "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
            "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
            "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
            "This is why our team tells a back story. It can and does happen to anyone.",
            "We apologize for so may typos and errors. We strive to do better at that."
          ],
          "public": 1,
          "adversary": "Tesla Hackers",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Vd",
              "display_name": "Vd",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Win.Trojan.12382640-1",
              "display_name": "Win.Trojan.12382640-1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 65,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 2032,
            "URL": 4921,
            "domain": 567,
            "hostname": 1586,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "98 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e8cd886e0bb692e8a9d08",
          "name": "Blocker Ransomware affecting Apple and iCloud  | Injection",
          "description": "Wild! Hackers attack-ack-acking!\nThey\u2019re quite good. Persistent. Angry. \nIt\u2019s the same group of hackers.",
          "modified": "2026-01-01T06:01:02.583000",
          "created": "2025-12-02T06:53:12.823000",
          "tags": [
            "url https",
            "url http",
            "domain",
            "fh no",
            "ipv4",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "pattern match",
            "mitre att",
            "ck id",
            "ck matrix",
            "ascii text",
            "href",
            "network traffic",
            "general",
            "local",
            "click",
            "strings",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "found",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "dynamicloader",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "write c",
            "unknown",
            "virtool",
            "write",
            "defender",
            "malware",
            "delete",
            "alerts",
            "backdoor",
            "high",
            "ip address",
            "t1045",
            "packing",
            "t1055",
            "injection",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1119",
            "t1027",
            "tools",
            "families",
            "mirai",
            "indicator role",
            "active related",
            "hackers",
            "ahmann",
            "usual suspects"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Drixed",
              "display_name": "Backdoor:Win32/Drixed",
              "target": "/malware/Backdoor:Win32/Drixed"
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            },
            {
              "id": "Ransom:Win32/Blocker.NN!MTB",
              "display_name": "Ransom:Win32/Blocker.NN!MTB",
              "target": "/malware/Ransom:Win32/Blocker.NN!MTB"
            },
            {
              "id": "Unix.Trojan.Mirai-7135937-0",
              "display_name": "Unix.Trojan.Mirai-7135937-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1470",
              "name": "Obtain Device Cloud Backups",
              "display_name": "T1470 - Obtain Device Cloud Backups"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1066",
              "name": "Indicator Removal from Tools",
              "display_name": "T1066 - Indicator Removal from Tools"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1408",
              "name": "Disguise Root/Jailbreak Indicators",
              "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1590.002",
              "name": "DNS",
              "display_name": "T1590.002 - DNS"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 234,
            "FileHash-SHA1": 219,
            "FileHash-SHA256": 841,
            "URL": 2606,
            "domain": 298,
            "hostname": 772,
            "SSLCertFingerprint": 2,
            "CVE": 1
          },
          "indicator_count": 4973,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://maps.googleapis.com/maps/api/js?sensor=false",
        "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
        "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
        "We apologize for so may typos and errors. We strive to do better at that.",
        "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
        "This is why our team tells a back story. It can and does happen to anyone.",
        "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
        "firebase-auth-eich0v.pages.dev",
        "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
        "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
        "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
        "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
        "IP\u2019s Contacted: 94.100.180.31  142.251.9.27  98.136.96.91  43.231.4.7  52.101.8.42",
        "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
        "Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
        "Attacks are being carried out by The State of Colorado",
        "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
        "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
        "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
        "Legal court documented  agreement to allow and pay target to hire cyber investigators",
        "howtoworkacrickoutofyourneck2.pages.dev",
        "Brian Sabey , Christopher P. Ahmann , State of Colorado who",
        "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
        "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
        "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
        "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
        "IDS Detections: tofsee",
        "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
        "cell-0.af-south-1.prod.telemetry.console.api.aws",
        "IDS Detections Win32/ZonaInstaller Install Beacon",
        "http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
        "Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked.",
        "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
        "Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
        "Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
        "Tesla Hackers  | https://www.teslarati.com/spacex",
        "Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
        "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
        "Instagram.com",
        "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
        "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
        "https://clear.ml/infrastructure-control-plane",
        "https://www.google-analytics.com/debug/bootstrap?id=\\",
        "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
        "https://khmerpornvideo.signup0.y.id/",
        "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
        "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
        "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com",
        "http://ianswertomom.com/develop-wise-woman-within-yourself",
        "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
        "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
        "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Tesla Hackers"
          ],
          "malware_families": [
            "Win.packed.bandook-9882274-1",
            "Win.trojan.tepfer-61",
            "#virtool:win32/obfuscator.adb",
            "Win.trojan.gravityrat-6511862-0",
            "Cve-2017-11882",
            "#lowfi:hstr:criakl.b1",
            "Unix.trojan.tsunami-6981155-0",
            "Vd",
            "Backdoor:win32/arwobot.b",
            "Win.packer.pkr_ce1a-9980177-0",
            "Unix.trojan.gafgyt-6981154-0",
            "Backdoor:win32/tofsee",
            "Nids",
            "Virtool:win32/injector",
            "Cycbot",
            "Mirai",
            "Mirai (elf)",
            "Trojandropper:win32/systex.a",
            "Backdoor:win32/tofsee.t",
            "Alf:exploit:o97m/cve-2017-8977",
            "Virtool:win32/vbinject.gen!mh",
            "Alf:heraklezeval:trojan:msil/gravityrat!rfn",
            "Win.downloader.small-4507",
            "Win.trojan.12382640-1",
            "Win32:botx-gen\\ [trj]",
            "Trojan:win32/emotet.yl",
            "Ransom:win32/crowti.a",
            "Trojan:win32/qbot.r!mtb",
            "Worm",
            "Trojandownloader:win32/cutwail",
            "Backdoor:win32/drixed",
            "Trojandownloader:win32/cutwailransom:win32/crowti.a",
            "Tofsee",
            "Autoit",
            "Ransom:win32/blocker.nn!mtb",
            "Ddos:linux/gafgyt.ya!mtb",
            "Htbot",
            "Alf:nid:susp_nsis_stub.a",
            "Win.malware.mikey-9949492-0",
            "Backdoor:linux/demonbot.aa!mtb",
            "Unix.trojan.mirai-7135937-0"
          ],
          "industries": [
            "Insurance",
            "Construction"
          ],
          "unique_indicators": 87766
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/getinge.com.tw",
    "whois": "http://whois.domaintools.com/getinge.com.tw",
    "domain": "getinge.com.tw",
    "hostname": "www.getinge.com.tw"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "69ca31b28c2fa3e734bf5000",
      "name": "instagram staged credit clone a vashti :(",
      "description": "",
      "modified": "2026-03-31T12:16:21.521000",
      "created": "2026-03-30T08:17:54.205000",
      "tags": [
        "dynamicloader",
        "port",
        "destination",
        "yara rule",
        "high",
        "tofsee",
        "rndhex",
        "rndchar",
        "loaderid",
        "write",
        "stream",
        "malware",
        "systemroot",
        "write c",
        "displayname",
        "windows",
        "trojan",
        "defender",
        "unknown",
        "less see",
        "all ip",
        "contacted",
        "less related",
        "meta",
        "emotet",
        "backdoor",
        "packer",
        "many",
        "hall render",
        "brian sabey",
        "christopher p. ahmann",
        "state of colorado",
        "google",
        "yahoo",
        "microsoft",
        "stealth window",
        "reads_self",
        "injection write process",
        "remote",
        "remote process",
        "dynamic function loading",
        "compromises device",
        "dead connect",
        "dynamic loader",
        "command",
        "cnc",
        "sleep sandbox",
        "iocontrol",
        "behavior tofsee",
        "suspicious code",
        "injection",
        "persistence",
        "rootkit",
        "social media",
        "belgium belgium",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "pattern match",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "network traffic",
        "t1071",
        "spawns",
        "html content",
        "href",
        "general",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "defense evasion",
        "development att",
        "tracking"
      ],
      "references": [
        "Instagram.com",
        "IDS Detections: tofsee",
        "Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
        "Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
        "Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
        "IP\u2019s Contacted: 94.100.180.31  142.251.9.27  98.136.96.91  43.231.4.7  52.101.8.42",
        "Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
        "Brian Sabey , Christopher P. Ahmann , State of Colorado who",
        "http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
        "Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Emotet.YL",
          "display_name": "Trojan:Win32/Emotet.YL",
          "target": "/malware/Trojan:Win32/Emotet.YL"
        },
        {
          "id": "Win.Packer.pkr_ce1a-9980177-0",
          "display_name": "Win.Packer.pkr_ce1a-9980177-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1589",
          "name": "Gather Victim Identity Information",
          "display_name": "T1589 - Gather Victim Identity Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1592",
          "name": "Gather Victim Host Information",
          "display_name": "T1592 - Gather Victim Host Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6949b6d8180bca3df9783578",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 911,
        "domain": 178,
        "hostname": 206,
        "FileHash-SHA256": 647,
        "FileHash-MD5": 38,
        "FileHash-SHA1": 28
      },
      "indicator_count": 2008,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693cdc5b8ebc10664439c2fb",
      "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - Freeman Mathis & Gary for The State of Colorado",
      "description": "State of Colorado attackers use  DGA domains set up multiple Law Firms.. Christopher P.  \u2019Buzz\u2019  Ahmann  Is a legal consultant / attorney./ hacker \nWorks for the State of Colorado/ quasi. Is malicious and doesn\u2019t work alone. Continues to target \nState had relative contacted by a fake entity \u2018Goodness Health\u2019\nLeft vague VM for relative message \u201cWe work on the Medicare side of things.\u201d and? \nSocial engineering call , malicious domain. The State of Colorado has been on a relentless pursuit against target. Fully compromised targets relatives brand new phone. Hacked target since 10/2013.\nMultiple cyber and physical attacks carried out  against target and family members.. There are attacks make  to look like accidents or malfunctions. This harmful, silencing behavior is somehow illegal for anyone else.",
      "modified": "2026-02-10T06:05:39.764000",
      "created": "2025-12-13T03:24:11.414000",
      "tags": [
        "colorado state",
        "freeman mathis",
        "history",
        "cyber risk",
        "aspen insureds",
        "gaig insureds",
        "landy insureds",
        "nip group",
        "purm insureds",
        "overview core",
        "united",
        "ip address",
        "present nov",
        "present may",
        "moved",
        "encrypt",
        "unknown",
        "backdoor",
        "passive dns",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "twitter",
        "trojan",
        "data upload",
        "extraction",
        "failed",
        "united states",
        "server response",
        "google safe",
        "results may",
        "lowfi",
        "virtool",
        "mtb alf",
        "mh alf",
        "port",
        "windows nt",
        "destination",
        "msie",
        "khtml",
        "gecko",
        "unknown aaaa",
        "a domains",
        "meta",
        "for privacy",
        "cop supply",
        "urls",
        "as139646 hong",
        "hostname",
        "files",
        "hong kong",
        "domain add",
        "ip related",
        "hash avast",
        "avg clamav",
        "msdefender may",
        "ddos",
        "as13335",
        "ipv4",
        "certificate",
        "hostname add",
        "url analysis",
        "files ip",
        "name strings",
        "category",
        "united states",
        "pulse indicator",
        "address",
        "error",
        "null",
        "object",
        "string",
        "number",
        "google maps",
        "promise",
        "javascript api",
        "dataset",
        "bigint",
        "dark",
        "android",
        "infinity",
        "internal",
        "roboto",
        "trident",
        "void",
        "small",
        "lightrail",
        "false",
        "span",
        "close",
        "light",
        "hybrid",
        "embed",
        "iframe",
        "keygen",
        "this",
        "february",
        "bounce",
        "drop",
        "inside",
        "outside",
        "marker",
        "present dec",
        "pulses otx",
        "aaaa",
        "asnone country",
        "record value",
        "title",
        "pulse pulses",
        "pulses",
        "showing",
        "unknown cname",
        "unknown soa",
        "next associated",
        "ipv4 add",
        "cycbot",
        "extract indic",
        "sneaker bots",
        "proxies data",
        "script script",
        "adult content",
        "nextimage",
        "porn site",
        "div div",
        "platform make",
        "cloudfront x",
        "hio52 p3",
        "unknown ns",
        "pulse submit",
        "title error",
        "reverse dns",
        "status",
        "servers",
        "name servers",
        "vashti hostname",
        "scan endpoints",
        "url http",
        "http",
        "files domain",
        "files related",
        "pulses none",
        "dnssec",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "version list",
        "domain",
        "emails",
        "cookie",
        "url https",
        "show",
        "filehash",
        "urls show",
        "date checked",
        "url hostname",
        "results nov",
        "win32",
        "type",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "llc name",
        "server",
        "markmonitor",
        "name server",
        "windir",
        "openurl c",
        "prefetch2",
        "show technique",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "sha1",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "germany unknown",
        "date",
        "registrar",
        "ip whois",
        "dynamicloader",
        "high",
        "medium",
        "search",
        "displayname",
        "tofsee",
        "win64",
        "write",
        "stream",
        "malware",
        "push",
        "entries",
        "tls handshake",
        "failure",
        "forbidden",
        "tlsv1",
        "april",
        "next",
        "write c",
        "intel",
        "ms windows",
        "sha1 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "sha256 add",
        "present jun",
        "present mar",
        "medelln",
        "colombia asn",
        "dns resolutions",
        "address domain",
        "related tags",
        "none google",
        "safe browsing",
        "external",
        "present sep",
        "present aug",
        "as54113",
        "present jul",
        "as8068",
        "gmt content",
        "total",
        "read",
        "delete",
        "top source",
        "quasi",
        "murderers",
        "christopher ahmann",
        "buzz ahmann",
        "wow64",
        "slcc2",
        "media center",
        "labor",
        "employment",
        "cdle",
        "dowc",
        "colorado",
        "workers",
        "coloradoif",
        "independent",
        "state",
        "company",
        "entity type",
        "authorized line",
        "analysis",
        "tor analysis",
        "process details",
        "network traffic",
        "t1071",
        "potential ip",
        "click",
        "found",
        "t1480 execution",
        "bad traffic",
        "et info",
        "ck techniques",
        "evasion att",
        "t1057",
        "refresh",
        "body",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "cname",
        "form",
        "pulse",
        "script domains",
        "script urls",
        "administrator",
        "services llc",
        "dns admin",
        "domain admin",
        "global llc",
        "domain manager",
        "computer system",
        "ltd domain",
        "network",
        "alibaba",
        "facebook",
        "phishme",
        "sogou",
        "present jan",
        "present feb",
        "present oct"
      ],
      "references": [
        "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
        "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
        "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
        "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
        "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
        "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
        "https://maps.googleapis.com/maps/api/js?sensor=false",
        "cell-0.af-south-1.prod.telemetry.console.api.aws",
        "howtoworkacrickoutofyourneck2.pages.dev",
        "firebase-auth-eich0v.pages.dev",
        "http://ianswertomom.com/develop-wise-woman-within-yourself",
        "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
        "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
        "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
        "https://khmerpornvideo.signup0.y.id/",
        "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
        "https://clear.ml/infrastructure-control-plane",
        "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
        "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
        "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
        "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
        "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
        "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
        "Legal court documented  agreement to allow and pay target to hire cyber investigators",
        "Attacks are being carried out by The State of Colorado"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "France",
        "Ireland",
        "Spain",
        "Italy",
        "Aruba",
        "Australia",
        "Denmark",
        "United Kingdom of Great Britain and Northern Ireland",
        "Germany",
        "T\u00fcrkiye",
        "Indonesia"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.GravityRAT-6511862-0",
          "display_name": "Win.Trojan.GravityRAT-6511862-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Unix.Trojan.Tsunami-6981155-0",
          "display_name": "Unix.Trojan.Tsunami-6981155-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Systex.A",
          "display_name": "TrojanDropper:Win32/Systex.A",
          "target": "/malware/TrojanDropper:Win32/Systex.A"
        },
        {
          "id": "Win.Trojan.Tepfer-61",
          "display_name": "Win.Trojan.Tepfer-61",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "target": null
        },
        {
          "id": "VirTool:Win32/VBInject.gen!MH",
          "display_name": "VirTool:Win32/VBInject.gen!MH",
          "target": "/malware/VirTool:Win32/VBInject.gen!MH"
        },
        {
          "id": "ALF:NID:Susp_NSIS_Stub.A",
          "display_name": "ALF:NID:Susp_NSIS_Stub.A",
          "target": null
        },
        {
          "id": "#LOWFI:HSTR:Criakl.B1",
          "display_name": "#LOWFI:HSTR:Criakl.B1",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Arwobot.B",
          "display_name": "Backdoor:Win32/Arwobot.B",
          "target": "/malware/Backdoor:Win32/Arwobot.B"
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        },
        {
          "id": "Win.Downloader.Small-4507",
          "display_name": "Win.Downloader.Small-4507",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qbot.R!MTB",
          "display_name": "Trojan:Win32/Qbot.R!MTB",
          "target": "/malware/Trojan:Win32/Qbot.R!MTB"
        },
        {
          "id": "Win.Malware.Mikey-9949492-0",
          "display_name": "Win.Malware.Mikey-9949492-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Backdoor:Linux/DemonBot.Aa!MTB",
          "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
          "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
        },
        {
          "id": "Unix.Trojan.Gafgyt-6981154-0",
          "display_name": "Unix.Trojan.Gafgyt-6981154-0",
          "target": null
        },
        {
          "id": "DDOS:Linux/Gafgyt.YA!MTB",
          "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "CVE-2017-11882",
          "display_name": "CVE-2017-11882",
          "target": null
        },
        {
          "id": "ALF:Exploit:O97M/CVE-2017-8977",
          "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
          "target": null
        },
        {
          "id": "Cycbot",
          "display_name": "Cycbot",
          "target": null
        },
        {
          "id": "Win32:BotX-gen\\ [Trj]",
          "display_name": "Win32:BotX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        },
        {
          "id": "Mirai (ELF)",
          "display_name": "Mirai (ELF)",
          "target": null
        },
        {
          "id": "Worm",
          "display_name": "Worm",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        }
      ],
      "industries": [
        "Insurance",
        "Construction"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 54118,
        "domain": 11153,
        "hostname": 18578,
        "email": 21,
        "FileHash-SHA256": 4905,
        "FileHash-MD5": 548,
        "FileHash-SHA1": 534,
        "CVE": 7,
        "SSLCertFingerprint": 20,
        "CIDR": 1
      },
      "indicator_count": 89885,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "68 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6963596c4cd594b77b4675ec",
      "name": "Project Cicada-.Christopher \u201cBuzz\u201d Ahmann - PalantirFoundry | The State of Colorado | ",
      "description": "",
      "modified": "2026-02-10T06:05:39.764000",
      "created": "2026-01-11T08:03:56.534000",
      "tags": [
        "colorado state",
        "freeman mathis",
        "history",
        "cyber risk",
        "aspen insureds",
        "gaig insureds",
        "landy insureds",
        "nip group",
        "purm insureds",
        "overview core",
        "united",
        "ip address",
        "present nov",
        "present may",
        "moved",
        "encrypt",
        "unknown",
        "backdoor",
        "passive dns",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "twitter",
        "trojan",
        "data upload",
        "extraction",
        "failed",
        "united states",
        "server response",
        "google safe",
        "results may",
        "lowfi",
        "virtool",
        "mtb alf",
        "mh alf",
        "port",
        "windows nt",
        "destination",
        "msie",
        "khtml",
        "gecko",
        "unknown aaaa",
        "a domains",
        "meta",
        "for privacy",
        "cop supply",
        "urls",
        "as139646 hong",
        "hostname",
        "files",
        "hong kong",
        "domain add",
        "ip related",
        "hash avast",
        "avg clamav",
        "msdefender may",
        "ddos",
        "as13335",
        "ipv4",
        "certificate",
        "hostname add",
        "url analysis",
        "files ip",
        "name strings",
        "category",
        "united states",
        "pulse indicator",
        "address",
        "error",
        "null",
        "object",
        "string",
        "number",
        "google maps",
        "promise",
        "javascript api",
        "dataset",
        "bigint",
        "dark",
        "android",
        "infinity",
        "internal",
        "roboto",
        "trident",
        "void",
        "small",
        "lightrail",
        "false",
        "span",
        "close",
        "light",
        "hybrid",
        "embed",
        "iframe",
        "keygen",
        "this",
        "february",
        "bounce",
        "drop",
        "inside",
        "outside",
        "marker",
        "present dec",
        "pulses otx",
        "aaaa",
        "asnone country",
        "record value",
        "title",
        "pulse pulses",
        "pulses",
        "showing",
        "unknown cname",
        "unknown soa",
        "next associated",
        "ipv4 add",
        "cycbot",
        "extract indic",
        "sneaker bots",
        "proxies data",
        "script script",
        "adult content",
        "nextimage",
        "porn site",
        "div div",
        "platform make",
        "cloudfront x",
        "hio52 p3",
        "unknown ns",
        "pulse submit",
        "title error",
        "reverse dns",
        "status",
        "servers",
        "name servers",
        "vashti hostname",
        "scan endpoints",
        "url http",
        "http",
        "files domain",
        "files related",
        "pulses none",
        "dnssec",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "version list",
        "domain",
        "emails",
        "cookie",
        "url https",
        "show",
        "filehash",
        "urls show",
        "date checked",
        "url hostname",
        "results nov",
        "win32",
        "type",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "llc name",
        "server",
        "markmonitor",
        "name server",
        "windir",
        "openurl c",
        "prefetch2",
        "show technique",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "sha1",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "germany unknown",
        "date",
        "registrar",
        "ip whois",
        "dynamicloader",
        "high",
        "medium",
        "search",
        "displayname",
        "tofsee",
        "win64",
        "write",
        "stream",
        "malware",
        "push",
        "entries",
        "tls handshake",
        "failure",
        "forbidden",
        "tlsv1",
        "april",
        "next",
        "write c",
        "intel",
        "ms windows",
        "sha1 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "sha256 add",
        "present jun",
        "present mar",
        "medelln",
        "colombia asn",
        "dns resolutions",
        "address domain",
        "related tags",
        "none google",
        "safe browsing",
        "external",
        "present sep",
        "present aug",
        "as54113",
        "present jul",
        "as8068",
        "gmt content",
        "total",
        "read",
        "delete",
        "top source",
        "quasi",
        "murderers",
        "christopher ahmann",
        "buzz ahmann",
        "wow64",
        "slcc2",
        "media center",
        "labor",
        "employment",
        "cdle",
        "dowc",
        "colorado",
        "workers",
        "coloradoif",
        "independent",
        "state",
        "company",
        "entity type",
        "authorized line",
        "analysis",
        "tor analysis",
        "process details",
        "network traffic",
        "t1071",
        "potential ip",
        "click",
        "found",
        "t1480 execution",
        "bad traffic",
        "et info",
        "ck techniques",
        "evasion att",
        "t1057",
        "refresh",
        "body",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "cname",
        "form",
        "pulse",
        "script domains",
        "script urls",
        "administrator",
        "services llc",
        "dns admin",
        "domain admin",
        "global llc",
        "domain manager",
        "computer system",
        "ltd domain",
        "network",
        "alibaba",
        "facebook",
        "phishme",
        "sogou",
        "present jan",
        "present feb",
        "present oct"
      ],
      "references": [
        "https://www.fmglaw.com/lawyers/christopher-ahmann - found in adult content pulse.",
        "Sneaker Bots Proxies Servers Cook Groups Cop Supply",
        "archive.cop.supply \u2022 dev.cop.supply \u2022 https://cop.supply/ \u2022 https://cop.supply/bot-lists/",
        "https://cop.supply/supreme-bots/\u2022 https://cop.supply/useful-tools/",
        "https://cop.supply/proxies-lists/ \u2022 https://cop.supply/shopify-bots/",
        "dns.army \u2022 www.dcopr.dns.army  \u2022 www.glsyaiwjj.dns.army \u2022  www.wgmvk.dns.army",
        "https://maps.googleapis.com/maps/api/js?sensor=false",
        "cell-0.af-south-1.prod.telemetry.console.api.aws",
        "howtoworkacrickoutofyourneck2.pages.dev",
        "firebase-auth-eich0v.pages.dev",
        "http://ianswertomom.com/develop-wise-woman-within-yourself",
        "http://ianswertomom.com/bible-verses-struggling-contentment-mom/  I",
        "https://i-want-to-start-an-onlyfans.pages.dev/favicon.ico| I bet you do boo boo",
        "makeapornsite.com \u2022 https://pornhighschool.com/ \u2022 https://ethnicerotic.com \u2022 https://twitter.com/Make",
        "https://khmerpornvideo.signup0.y.id/",
        "https://lordseriala.life/6337-zvezdnye-vojny-opornaja-komanda.html",
        "https://clear.ml/infrastructure-control-plane",
        "dev-app.project-cicada.com \u2022 http://dev-app.project-cicada.com \u2022 https://dev-app.project-cicada.com (2014 report predates 2016 reports)",
        "https://amano.inboundtools.com/tpcontact  URL https://armg.inboundtools.com/  URL https://gaiax.inboundtools.com/internship  URL https://hmk.inboundtools.com/  URL https://hmk.inboundtools.com/form/assetview_siryo_sier",
        "https://download.clear.ml/cpython_builds/releases/ \u2022 https://download.clear.",
        "https://links.mail.samsara.com/s/c/P9R6gGlExR4nfCwqwJXUmr7NmKcMNde4ZBhCFprlVtsFNgh-4tuTWla0aXN9rIWCjrWtn0Vln7x-hexxVBlY3xxvnEevR8qJU5G5xV3__wo-X7kkpSOhJVfejac-Xk8qu6zs5Z-tILwWYRkNScZNGlAqfwQuJuRw5M-n_ZKI6tuY5XGCZAqWoQepi1NnJiW4wZJkzZlOwGtNkusbuKDcMsLVrrhji2eKh4kYgrJp_SeycJRhasLFCQ3c2bPu4sahEWpcHZrQBaxvdfQgTEno8kV-RJdTDO0zK5MyWDJLeds7mnaDrxlb0O2zmhebUdlHE0R0xHi25dympBUpMlLsQV8bx1WUTOfgK4k0ci9o_2Gbfe22-jLxsJN-msV6pxWYQMaxRNFd4iZRC9J9Z1SC5MBqbvNzqdt98kFdpibnv_QIHdhFyHOR_Ip_LX67Dncc8V8OvAi-H5phfeSyDzwdzf2FQIi82",
        "https://voidpet.io/invite/scaredscared/1rpzxWXa61 \u2022 https://sex-doggy.net/tag/censored",
        "Everyone has simply asked you alll to stop. Target never asked anyone for money.",
        "Legal court documented  agreement to allow and pay target to hire cyber investigators",
        "Attacks are being carried out by The State of Colorado"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "France",
        "Ireland",
        "Spain",
        "Italy",
        "Aruba",
        "Australia",
        "Denmark",
        "United Kingdom of Great Britain and Northern Ireland",
        "Germany",
        "T\u00fcrkiye",
        "Indonesia"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.GravityRAT-6511862-0",
          "display_name": "Win.Trojan.GravityRAT-6511862-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn",
          "target": null
        },
        {
          "id": "Unix.Trojan.Tsunami-6981155-0",
          "display_name": "Unix.Trojan.Tsunami-6981155-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Systex.A",
          "display_name": "TrojanDropper:Win32/Systex.A",
          "target": "/malware/TrojanDropper:Win32/Systex.A"
        },
        {
          "id": "Win.Trojan.Tepfer-61",
          "display_name": "Win.Trojan.Tepfer-61",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "display_name": "TrojanDownloader:Win32/CutwailRansom:Win32/Crowti.A",
          "target": null
        },
        {
          "id": "VirTool:Win32/VBInject.gen!MH",
          "display_name": "VirTool:Win32/VBInject.gen!MH",
          "target": "/malware/VirTool:Win32/VBInject.gen!MH"
        },
        {
          "id": "ALF:NID:Susp_NSIS_Stub.A",
          "display_name": "ALF:NID:Susp_NSIS_Stub.A",
          "target": null
        },
        {
          "id": "#LOWFI:HSTR:Criakl.B1",
          "display_name": "#LOWFI:HSTR:Criakl.B1",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Arwobot.B",
          "display_name": "Backdoor:Win32/Arwobot.B",
          "target": "/malware/Backdoor:Win32/Arwobot.B"
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        },
        {
          "id": "Win.Downloader.Small-4507",
          "display_name": "Win.Downloader.Small-4507",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qbot.R!MTB",
          "display_name": "Trojan:Win32/Qbot.R!MTB",
          "target": "/malware/Trojan:Win32/Qbot.R!MTB"
        },
        {
          "id": "Win.Malware.Mikey-9949492-0",
          "display_name": "Win.Malware.Mikey-9949492-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Backdoor:Linux/DemonBot.Aa!MTB",
          "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
          "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
        },
        {
          "id": "Unix.Trojan.Gafgyt-6981154-0",
          "display_name": "Unix.Trojan.Gafgyt-6981154-0",
          "target": null
        },
        {
          "id": "DDOS:Linux/Gafgyt.YA!MTB",
          "display_name": "DDOS:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDOS:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "CVE-2017-11882",
          "display_name": "CVE-2017-11882",
          "target": null
        },
        {
          "id": "ALF:Exploit:O97M/CVE-2017-8977",
          "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
          "target": null
        },
        {
          "id": "Cycbot",
          "display_name": "Cycbot",
          "target": null
        },
        {
          "id": "Win32:BotX-gen\\ [Trj]",
          "display_name": "Win32:BotX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        },
        {
          "id": "Mirai (ELF)",
          "display_name": "Mirai (ELF)",
          "target": null
        },
        {
          "id": "Worm",
          "display_name": "Worm",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1204.001",
          "name": "Malicious Link",
          "display_name": "T1204.001 - Malicious Link"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        }
      ],
      "industries": [
        "Insurance",
        "Construction"
      ],
      "TLP": "green",
      "cloned_from": "693cdc5b8ebc10664439c2fb",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 54118,
        "domain": 11153,
        "hostname": 18578,
        "email": 21,
        "FileHash-SHA256": 4905,
        "FileHash-MD5": 548,
        "FileHash-SHA1": 534,
        "CVE": 7,
        "SSLCertFingerprint": 20,
        "CIDR": 1
      },
      "indicator_count": 89885,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "68 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6949b6d8180bca3df9783578",
      "name": "Instagram (staged) Emotet & Tofsee Backdoor",
      "description": "If you choose to read this, I apologize for the riddle.Pegasus like tracking operation.\nAdversarial attack on a private citizens or (possibly staged instagram account). The citizen is not a known target. Attacks appear to arise from same internet criminals, allegedly State of Colorado employees engaged in permissible criminal behavior. Account does belongs to a person in sphere of a known monitored target. Target naturally has no communication with account holder. Known target had been invited to be Facebook friends of infected account holder multiple times, both target and associate declined and blocked this infected account holder. |\n\n* Infected Instagram account holders husband referred target to a Colorado Law Firm. The Law firm was attacked some time ago. | \n***Infected instagram account holder name is  redacted. Is being tracked :(",
      "modified": "2026-01-21T20:01:56.174000",
      "created": "2025-12-22T21:23:36.083000",
      "tags": [
        "dynamicloader",
        "port",
        "destination",
        "yara rule",
        "high",
        "tofsee",
        "rndhex",
        "rndchar",
        "loaderid",
        "write",
        "stream",
        "malware",
        "systemroot",
        "write c",
        "displayname",
        "windows",
        "trojan",
        "defender",
        "unknown",
        "less see",
        "all ip",
        "contacted",
        "less related",
        "meta",
        "emotet",
        "backdoor",
        "packer",
        "many",
        "hall render",
        "brian sabey",
        "christopher p. ahmann",
        "state of colorado",
        "google",
        "yahoo",
        "microsoft",
        "stealth window",
        "reads_self",
        "injection write process",
        "remote",
        "remote process",
        "dynamic function loading",
        "compromises device",
        "dead connect",
        "dynamic loader",
        "command",
        "cnc",
        "sleep sandbox",
        "iocontrol",
        "behavior tofsee",
        "suspicious code",
        "injection",
        "persistence",
        "rootkit",
        "social media",
        "belgium belgium",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "pattern match",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "network traffic",
        "t1071",
        "spawns",
        "html content",
        "href",
        "general",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "defense evasion",
        "development att",
        "tracking"
      ],
      "references": [
        "Instagram.com",
        "IDS Detections: tofsee",
        "Alerts antivm_generic_services persistence_ads anomalous_deletefile Idead_connect",
        "Alerts: suspicious_tld queries_computer_name dynamic_function_loading",
        "Alerts: antidebug_setunhandledexceptionfilter antivm_network_adapters",
        "IP\u2019s Contacted: 94.100.180.31  142.251.9.27  98.136.96.91  43.231.4.7  52.101.8.42",
        "Domains Contacted microsoft.com microsoft-com.mail.protection.outlook.com yahoo.com mta7.am0.yahoodns.net google.com",
        "Brian Sabey , Christopher P. Ahmann , State of Colorado who",
        "http://tracking-sa3.account.riyadhair.com/tracking/1/open/UGnB4w8RQiQ_9PYty4S-rwBmOetPQw3ubFHSNKg_IdhZfkaCbjqN3pnR4Xwk6pQcRBqF2aoq0uEaKMM4CX1kTpZsAD10-fxAPEgqGzJ2o7BJmsh_G2B6P-m_Xqc_LOycbcGBss0kXIEJvMGRw2SMITzqmVnh1yI_FuZV37qgGHZG3lP1V-WMaNTc8FYNIcgSRyTFamC5k3I1LkpsmTgX5Dd20Ko3IxUqFRC74clpVo-uFwRAb1Q1gSfKrDBX6_LaXkgv9gfyPy7L2BKxAmFBe-Ump3D_wGRDTXekPO5VZJ46hn0pUrOy2g8606kgb703eJVnmrz0cgCd-8P1dOdfoOFrSqOuXzfDNCaUU-2xl1aHVjGCZGIWX6B4bYqznMqsvI8UxoitF5tZTZ3opRhymDkrsItHdJPUnzkc6N_Z370RVT54BihKCohH14lIRQVQN9v74E",
        "Looks like a Pegasus tracking sphere. All contacts and contacts, contacts tracked."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Emotet.YL",
          "display_name": "Trojan:Win32/Emotet.YL",
          "target": "/malware/Trojan:Win32/Emotet.YL"
        },
        {
          "id": "Win.Packer.pkr_ce1a-9980177-0",
          "display_name": "Win.Packer.pkr_ce1a-9980177-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1589",
          "name": "Gather Victim Identity Information",
          "display_name": "T1589 - Gather Victim Identity Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1592",
          "name": "Gather Victim Host Information",
          "display_name": "T1592 - Gather Victim Host Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 910,
        "domain": 177,
        "hostname": 206,
        "FileHash-SHA256": 647,
        "FileHash-MD5": 38,
        "FileHash-SHA1": 28
      },
      "indicator_count": 2006,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "88 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693de4a8a72cf95b028365f0",
      "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee",
      "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets",
      "modified": "2026-01-12T21:02:35.560000",
      "created": "2025-12-13T22:11:52.474000",
      "tags": [
        "network",
        "ip address",
        "subnet",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "windows",
        "united",
        "write",
        "tofsee",
        "stream",
        "win64",
        "push",
        "urls",
        "url analysis",
        "dnssec",
        "script domains",
        "encrypt",
        "url add",
        "http",
        "related nids",
        "flag united",
        "germany",
        "address google",
        "passive dns",
        "ipv4 add",
        "files",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "location united",
        "asn asnone",
        "present dec",
        "backdoor",
        "lowfi",
        "win32autoit mar",
        "urls show",
        "date checked",
        "connection",
        "httponly",
        "secure",
        "path",
        "expiressat",
        "dynamic cfray",
        "medium",
        "delete c",
        "displayname",
        "show",
        "unknown",
        "next",
        "rndhex",
        "malware",
        "cname",
        "next associated",
        "url hostname",
        "server response",
        "google safe",
        "read c",
        "unicode",
        "png image",
        "rgba",
        "memcommit",
        "dock",
        "execution",
        "files location",
        "china flag",
        "china hostname",
        "hostname",
        "domain",
        "files ip",
        "address",
        "asn as45102",
        "gmt content",
        "certificate",
        "associated urls",
        "location china",
        "china asn",
        "as4808 china",
        "present aug",
        "object",
        "present apr",
        "present oct",
        "alman",
        "present sep",
        "error",
        "present jul",
        "rmndrp",
        "present feb",
        "expiration",
        "url https",
        "url http",
        "iocs",
        "review iocs",
        "expireswed",
        "samesitenone",
        "maxage86400",
        "maxage0",
        "server",
        "expires",
        "victina nulcac",
        "data upload",
        "extraction",
        "enter",
        "enter source",
        "url data",
        "type",
        "extract indic",
        "included iocs",
        "china unknown",
        "botnet",
        "folk in browser",
        "japan unknown",
        "asnone country",
        "as13335",
        "a domains",
        "script urls",
        "servers",
        "title",
        "moved",
        "record value",
        "entries",
        "whitelisted",
        "powershell",
        "xf9xb5xf9",
        "xxcexf6x8fr",
        "k2xe7xcbxxeaxa2",
        "x99x19",
        "x88yxf9xc858",
        "x83x12x8da",
        "zx9bx8ex84",
        "attempts",
        "yara detections",
        "contacted",
        "tags none",
        "file type",
        "pe packer",
        "dll compilation",
        "guard",
        "botnets"
      ],
      "references": [
        "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
        "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
        "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
        "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
        "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America",
        "Russian Federation",
        "T\u00fcrkiye",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Win32/Tofsee",
          "display_name": "Backdoor:Win32/Tofsee",
          "target": "/malware/Backdoor:Win32/Tofsee"
        },
        {
          "id": "AutoIT",
          "display_name": "AutoIT",
          "target": null
        },
        {
          "id": "HtBot",
          "display_name": "HtBot",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1195.001",
          "name": "Compromise Software Dependencies and Development Tools",
          "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1481",
          "name": "Web Service",
          "display_name": "T1481 - Web Service"
        },
        {
          "id": "T1534",
          "name": "Internal Spearphishing",
          "display_name": "T1534 - Internal Spearphishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8145,
        "domain": 1389,
        "FileHash-SHA256": 1545,
        "CIDR": 2,
        "hostname": 2533,
        "FileHash-MD5": 209,
        "FileHash-SHA1": 190,
        "email": 6,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 14023,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "97 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "693b7dc3cf1996347652ef92",
      "name": "Google Site Redirector - Tesla Hackers",
      "description": "Silencing. By Tesla hackers. Awful example of how any victim of a crime; can become a target of the government..\nThis is especially true when the actual perpetrators work for the government are government affiliated, very wealthy, a celebrity or someone who is deemed important. In this instance the Quasi government sought to keep target seeking and obtaining life saving medical treatment, financial settlement that she was entitled to from assault, injuries from assault, false imprisonment, punitive damgages, pain and suffering, humiliation, premise liability, permanent (whole body disability @MMI ), many other crimes. The victims suffered from a great sadness and betrayal. \n\nObviously racist Elon Musk and crew have access to all government tools. Musk, All things cyber are at his disposal as \ncontinues to abuse privilege.\n They keep  playing a God  they  don\u2019t believe in. God is the Ultimate Avenger.",
      "modified": "2026-01-11T00:03:08.581000",
      "created": "2025-12-12T02:28:19.107000",
      "tags": [
        "compromised_site_redirector_fromcharcode",
        "site_redirector",
        "string",
        "regexp",
        "error",
        "number",
        "sxa0",
        "amptoken",
        "optout",
        "retrieving",
        "notfound",
        "write",
        "form",
        "flash",
        "vd",
        "tesla hackers",
        "nxdomain",
        "passive dns",
        "ip address",
        "domain",
        "a nxdomain",
        "urls",
        "files",
        "ip related",
        "pulses otx",
        "google",
        "unknown",
        "oracle",
        "dynamicloader",
        "medium",
        "high",
        "windows",
        "rndhex",
        "write c",
        "rndchar",
        "displayname",
        "tofsee",
        "yara rule",
        "stream",
        "strings",
        "push",
        "lte all",
        "search otx",
        "ource url",
        "or text",
        "paste",
        "data upload",
        "extraction",
        "elon musk",
        "indicator role",
        "active related",
        "ipv4",
        "exploitsource",
        "url https",
        "url http",
        "desktopinternet",
        "title added",
        "pulses ipv4",
        "less see",
        "ids detections",
        "vuze bt",
        "udp connection",
        "contacted",
        "filehash",
        "av detections",
        "yara detections",
        "alerts",
        "0x8aa42",
        "0xe3107",
        "upnp",
        "http request",
        "bittorrent",
        "file",
        "module load",
        "t1129",
        "post http",
        "install",
        "execution",
        "malware",
        "hostile",
        "crawl",
        "windows nt",
        "wow64",
        "get zona",
        "get httpget",
        "hash",
        "entries",
        "read c",
        "suspicious",
        "next",
        "united"
      ],
      "references": [
        "Tesla Hackers  | https://www.teslarati.com/spacex",
        "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
        "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
        "IDS Detections Win32/ZonaInstaller Install Beacon",
        "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
        "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
        "https://www.google-analytics.com/debug/bootstrap?id=\\",
        "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
        "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
        "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
        "This is why our team tells a back story. It can and does happen to anyone.",
        "We apologize for so may typos and errors. We strive to do better at that."
      ],
      "public": 1,
      "adversary": "Tesla Hackers",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Vd",
          "display_name": "Vd",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Win.Trojan.12382640-1",
          "display_name": "Win.Trojan.12382640-1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 65,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 2032,
        "URL": 4921,
        "domain": 567,
        "hostname": 1586,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "98 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e8cd886e0bb692e8a9d08",
      "name": "Blocker Ransomware affecting Apple and iCloud  | Injection",
      "description": "Wild! Hackers attack-ack-acking!\nThey\u2019re quite good. Persistent. Angry. \nIt\u2019s the same group of hackers.",
      "modified": "2026-01-01T06:01:02.583000",
      "created": "2025-12-02T06:53:12.823000",
      "tags": [
        "url https",
        "url http",
        "domain",
        "fh no",
        "ipv4",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "pattern match",
        "mitre att",
        "ck id",
        "ck matrix",
        "ascii text",
        "href",
        "network traffic",
        "general",
        "local",
        "click",
        "strings",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "found",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "dynamicloader",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "write c",
        "unknown",
        "virtool",
        "write",
        "defender",
        "malware",
        "delete",
        "alerts",
        "backdoor",
        "high",
        "ip address",
        "t1045",
        "packing",
        "t1055",
        "injection",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1119",
        "t1027",
        "tools",
        "families",
        "mirai",
        "indicator role",
        "active related",
        "hackers",
        "ahmann",
        "usual suspects"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Drixed",
          "display_name": "Backdoor:Win32/Drixed",
          "target": "/malware/Backdoor:Win32/Drixed"
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        },
        {
          "id": "Ransom:Win32/Blocker.NN!MTB",
          "display_name": "Ransom:Win32/Blocker.NN!MTB",
          "target": "/malware/Ransom:Win32/Blocker.NN!MTB"
        },
        {
          "id": "Unix.Trojan.Mirai-7135937-0",
          "display_name": "Unix.Trojan.Mirai-7135937-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1470",
          "name": "Obtain Device Cloud Backups",
          "display_name": "T1470 - Obtain Device Cloud Backups"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1066",
          "name": "Indicator Removal from Tools",
          "display_name": "T1066 - Indicator Removal from Tools"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1408",
          "name": "Disguise Root/Jailbreak Indicators",
          "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1590.002",
          "name": "DNS",
          "display_name": "T1590.002 - DNS"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 234,
        "FileHash-SHA1": 219,
        "FileHash-SHA256": 841,
        "URL": 2606,
        "domain": 298,
        "hostname": 772,
        "SSLCertFingerprint": 2,
        "CVE": 1
      },
      "indicator_count": 4973,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.getinge.com.tw",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.getinge.com.tw",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776640883.3495224
}