{
  "type": "URL",
  "indicator": "https://www.jennbilton.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.jennbilton.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3783171501,
      "indicator": "https://www.jennbilton.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "686adf91f725a8b7f9850192",
          "name": "Dystopian Life  & Death of an American Crime Victim | Boldy predicted how she will die",
          "description": "Palantir - a data analytics company, known as a military intelligence tool. co-founded by billionaire investor , Trump supporter and Republican mega donor Musk aligned; Peter Thiel, as per New York. \n\nFounded in 2003, known for its data analytics platforms  -  Palantir Gotham & Palantir Foundry are used by government & private sectors for various applications, including defense & healthcare. The company faces criticism for its role in government surveillance & data privacy concerns.\nPalantir can be linked to malicious, malware packed , compromised malvertisements about  victim allegedly SA\u2019d by her physical therapist Jeffrey Scott Reimer DPT. Apparently target was paid a small settlement via lengthy phone battle by a man representing himself as Brian Sabey ,Esq of Hall Render. \n Palantir, admittedly designs cyber weapon that \u2018kills people\u2019. Are governments abusing to terrorize, silence  & even harm/kill American citizens.  Is this an elaborate hoax?\nTeam 8 \n#rip #plantantir #Hosanna #dystopian #targeted",
          "modified": "2025-08-05T15:03:36.451000",
          "created": "2025-07-06T20:41:53.748000",
          "tags": [
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "showing",
            "entries",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "ipv4",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "indicators show",
            "search",
            "reputation",
            "et att",
            "ck id",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "scan",
            "iocs",
            "learn more",
            "hostname",
            "types of",
            "pagehrsappjbpst",
            "actionu",
            "focusapplicant",
            "siteid1",
            "postingseq1",
            "t1036",
            "t1043",
            "port",
            "t1085",
            "rundll32",
            "t1114",
            "t1179",
            "fbi flash",
            "cu000163mw",
            "compromise",
            "found",
            "uunet",
            "code",
            "reverse domain",
            "lookup",
            "ragnar",
            "locker",
            "ragnar locker",
            "cidr",
            "pulses",
            "types",
            "windows",
            "linux",
            "united",
            "trojandropper",
            "mtb jun",
            "trojan",
            "win32upatre aug",
            "mtb may",
            "gmt server",
            "ecacc",
            "files",
            "suspicious",
            "body",
            "data upload",
            "extraction",
            "cve cve20170147",
            "cve cve20178570",
            "cve cve20178977",
            "url feb",
            "pulses hostname",
            "a1sticas",
            "next associated",
            "present mar",
            "present jun",
            "present may",
            "france",
            "date",
            "ip address",
            "present apr",
            "virtool",
            "name servers",
            "value emails",
            "name john",
            "shipton",
            "dynadot privacy",
            "po box",
            "city san",
            "mateo country",
            "us creation",
            "news videos",
            "maps assist",
            "search settings",
            "safe search",
            "date more",
            "images bae",
            "systems defense",
            "bae systems",
            "london",
            "britain",
            "akamai rank",
            "script urls",
            "status",
            "a domains",
            "accept encoding",
            "unknown ns",
            "meta",
            "encrypt",
            "https",
            "report spam",
            "created",
            "year ago",
            "modified",
            "octoseek public",
            "cyber attack",
            "pegasus",
            "westlaw",
            "hallrender",
            "front",
            "sabey",
            "enter s",
            "include review",
            "exclude sugges",
            "failed",
            "sc type",
            "extr included",
            "manually add",
            "puls",
            "excludedocs",
            "sugges data",
            "phishing",
            "apple pegasus",
            "detections",
            "references",
            "stranger things",
            "http",
            "yara",
            "upx alerts",
            "fort collins",
            "help4u",
            "communications",
            "orgtechhandle",
            "domain",
            "no entries",
            "cchk asnas26658",
            "vj92",
            "search filter",
            "time sabey",
            "x show",
            "indicator type",
            "email",
            "filehashimphash",
            "filehashpehash",
            "backdoor",
            "ransom",
            "checkin",
            "alphacrypt cnc",
            "beacon",
            "jeffrey scott",
            "terse http",
            "possible",
            "accept",
            "xorddos",
            "ck ids",
            "t1512",
            "camera",
            "t1071",
            "protocol",
            "ta0001",
            "access",
            "ta0002",
            "ta0003",
            "ta0004",
            "cookie",
            "show",
            "ally",
            "melika",
            "part1",
            "trojanclicker",
            "bayrob",
            "android",
            "ransomware",
            "sakula rat",
            "t1125",
            "video capture",
            "t1566",
            "t1068",
            "t1190",
            "application",
            "t1472",
            "t1457",
            "media content",
            "social media",
            "doppelgnging",
            "t1080",
            "shared content",
            "t1449",
            "exploit ss7",
            "phone callssms",
            "enter sc",
            "type",
            "no expiration",
            "expiration",
            "months ago",
            "expiration http",
            "reimer dpt",
            "r role",
            "sa victim",
            "daisy coleman",
            "source",
            "weeks ago",
            "tbmvid",
            "sourcelnms",
            "zx1724209326040",
            "ahtrnaah typ",
            "url url",
            "url domain",
            "pulse sthow",
            "ah types",
            "ind indicator",
            "data uptoad",
            "extrachttp",
            "dulce sphown",
            "aho data",
            "typ url",
            "url dom",
            "hos hostname",
            "hos host",
            "dom dom"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8149,
            "domain": 1067,
            "hostname": 2103,
            "FileHash-SHA256": 1617,
            "URI": 1,
            "FilePath": 1,
            "FileHash-MD5": 412,
            "FileHash-SHA1": 368,
            "CIDR": 4,
            "CVE": 6,
            "email": 10
          },
          "indicator_count": 13738,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "258 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "686c676bcc053e0fc51f01b2",
          "name": "ALL T8 research led to Firm_IP\u2019s = BoFa , WikiLeaks, United Healthcare, HCA, T-Mobile, Dish , AT&T,  Apple,+ Breaches despite other speculations with 0 relations",
          "description": "",
          "modified": "2025-08-05T15:03:36.451000",
          "created": "2025-07-08T00:33:47.021000",
          "tags": [
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "showing",
            "entries",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "ipv4",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "indicators show",
            "search",
            "reputation",
            "et att",
            "ck id",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "scan",
            "iocs",
            "learn more",
            "hostname",
            "types of",
            "pagehrsappjbpst",
            "actionu",
            "focusapplicant",
            "siteid1",
            "postingseq1",
            "t1036",
            "t1043",
            "port",
            "t1085",
            "rundll32",
            "t1114",
            "t1179",
            "fbi flash",
            "cu000163mw",
            "compromise",
            "found",
            "uunet",
            "code",
            "reverse domain",
            "lookup",
            "ragnar",
            "locker",
            "ragnar locker",
            "cidr",
            "pulses",
            "types",
            "windows",
            "linux",
            "united",
            "trojandropper",
            "mtb jun",
            "trojan",
            "win32upatre aug",
            "mtb may",
            "gmt server",
            "ecacc",
            "files",
            "suspicious",
            "body",
            "data upload",
            "extraction",
            "cve cve20170147",
            "cve cve20178570",
            "cve cve20178977",
            "url feb",
            "pulses hostname",
            "a1sticas",
            "next associated",
            "present mar",
            "present jun",
            "present may",
            "france",
            "date",
            "ip address",
            "present apr",
            "virtool",
            "name servers",
            "value emails",
            "name john",
            "shipton",
            "dynadot privacy",
            "po box",
            "city san",
            "mateo country",
            "us creation",
            "news videos",
            "maps assist",
            "search settings",
            "safe search",
            "date more",
            "images bae",
            "systems defense",
            "bae systems",
            "london",
            "britain",
            "akamai rank",
            "script urls",
            "status",
            "a domains",
            "accept encoding",
            "unknown ns",
            "meta",
            "encrypt",
            "https",
            "report spam",
            "created",
            "year ago",
            "modified",
            "octoseek public",
            "cyber attack",
            "pegasus",
            "westlaw",
            "hallrender",
            "front",
            "sabey",
            "enter s",
            "include review",
            "exclude sugges",
            "failed",
            "sc type",
            "extr included",
            "manually add",
            "puls",
            "excludedocs",
            "sugges data",
            "phishing",
            "apple pegasus",
            "detections",
            "references",
            "stranger things",
            "http",
            "yara",
            "upx alerts",
            "fort collins",
            "help4u",
            "communications",
            "orgtechhandle",
            "domain",
            "no entries",
            "cchk asnas26658",
            "vj92",
            "search filter",
            "time sabey",
            "x show",
            "indicator type",
            "email",
            "filehashimphash",
            "filehashpehash",
            "backdoor",
            "ransom",
            "checkin",
            "alphacrypt cnc",
            "beacon",
            "jeffrey scott",
            "terse http",
            "possible",
            "accept",
            "xorddos",
            "ck ids",
            "t1512",
            "camera",
            "t1071",
            "protocol",
            "ta0001",
            "access",
            "ta0002",
            "ta0003",
            "ta0004",
            "cookie",
            "show",
            "ally",
            "melika",
            "part1",
            "trojanclicker",
            "bayrob",
            "android",
            "ransomware",
            "sakula rat",
            "t1125",
            "video capture",
            "t1566",
            "t1068",
            "t1190",
            "application",
            "t1472",
            "t1457",
            "media content",
            "social media",
            "doppelgnging",
            "t1080",
            "shared content",
            "t1449",
            "exploit ss7",
            "phone callssms",
            "enter sc",
            "type",
            "no expiration",
            "expiration",
            "months ago",
            "expiration http",
            "reimer dpt",
            "r role",
            "sa victim",
            "daisy coleman",
            "source",
            "weeks ago",
            "tbmvid",
            "sourcelnms",
            "zx1724209326040",
            "ahtrnaah typ",
            "url url",
            "url domain",
            "pulse sthow",
            "ah types",
            "ind indicator",
            "data uptoad",
            "extrachttp",
            "dulce sphown",
            "aho data",
            "typ url",
            "url dom",
            "hos hostname",
            "hos host",
            "dom dom"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1085",
              "name": "Rundll32",
              "display_name": "T1085 - Rundll32"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1051",
              "name": "Shared Webroot",
              "display_name": "T1051 - Shared Webroot"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1506",
              "name": "Web Session Cookie",
              "display_name": "T1506 - Web Session Cookie"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "686adf91f725a8b7f9850192",
          "export_count": 56,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8149,
            "domain": 1067,
            "hostname": 2103,
            "FileHash-SHA256": 1617,
            "URI": 1,
            "FilePath": 1,
            "FileHash-MD5": 412,
            "FileHash-SHA1": 368,
            "CIDR": 4,
            "CVE": 6,
            "email": 10
          },
          "indicator_count": 13738,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "258 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655650c9b2be6cc930c92cf3",
          "name": "https://myaccount.uscis.gov/",
          "description": "HOW!?!? My device was remotely logged into this account somehow.\nThis is egregious. Silence  Threats. I have no connection to this but was contacted by a while ago. I don't know how or why a part of the government would attack a person with a TBI and C1 - S1 Spinal cord injury allegedly caused by Colorado physical therapist and protect him. Why  is victim, tracked and unsafe, receiving death threats, monitored, denied medical care, stalked EVERYWHERE.   \nEven felons aren't monitored for life. STOP.\nWill this get us killed. Do the right thing.\nGod bless America, purge the government.\nThe truth should set you fee not get you harmed.",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:26:33",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 102,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655652f6ddcbf952a599cded",
          "name": "https://myaccount.uscis.gov/",
          "description": "After Mark Montano Md reported alleged acts by Jeffrey Scott Reimer after receiving 'multiple' reports of him aggressively pursuing Brashears, she was contacted, told she violated the Patriot Act by Big O Tires?!! Received letters from the above and harassed for years. Colorado Workers compensation is so corrupt this may be my last post. She was immediately framed , blamed, porn smeared and stalked. Denied medical care , when received died on surgery table, revised and disabled. Even the mafia would  tackle only the associates bringing undue negative attention to their  own organization.",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:35:50.285000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 100,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65565477da453c46f05a6ac4",
          "name": "BTW VirusTotal - \" interesting files written to disk during execution'",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:42:15.123000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 101,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655657ca2e402d4f98283de9",
          "name": "https://myaccount.uscis.gov/ ",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:56:26.312000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 100,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655686e2c072557f03e9cba2",
          "name": "https://myaccount.uscis.gov/                         [pulse created by Octoseek]",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T21:17:22.087000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 102,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65580c52bf98f256b6a01da6",
          "name": "https://myaccount.uscis.gov/",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-18T00:58:58.944000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 101,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656aac25a8a2caaddf0d3b88",
          "name": "https://myaccount.uscis.gov/",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-12-02T04:01:41.427000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655652f6ddcbf952a599cded",
          "export_count": 93,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "856 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Redline",
            "Lumma",
            "Webtoolbar",
            "Trojanspy"
          ],
          "industries": [],
          "unique_indicators": 53643
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/jennbilton.com",
    "whois": "http://whois.domaintools.com/jennbilton.com",
    "domain": "jennbilton.com",
    "hostname": "www.jennbilton.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "686adf91f725a8b7f9850192",
      "name": "Dystopian Life  & Death of an American Crime Victim | Boldy predicted how she will die",
      "description": "Palantir - a data analytics company, known as a military intelligence tool. co-founded by billionaire investor , Trump supporter and Republican mega donor Musk aligned; Peter Thiel, as per New York. \n\nFounded in 2003, known for its data analytics platforms  -  Palantir Gotham & Palantir Foundry are used by government & private sectors for various applications, including defense & healthcare. The company faces criticism for its role in government surveillance & data privacy concerns.\nPalantir can be linked to malicious, malware packed , compromised malvertisements about  victim allegedly SA\u2019d by her physical therapist Jeffrey Scott Reimer DPT. Apparently target was paid a small settlement via lengthy phone battle by a man representing himself as Brian Sabey ,Esq of Hall Render. \n Palantir, admittedly designs cyber weapon that \u2018kills people\u2019. Are governments abusing to terrorize, silence  & even harm/kill American citizens.  Is this an elaborate hoax?\nTeam 8 \n#rip #plantantir #Hosanna #dystopian #targeted",
      "modified": "2025-08-05T15:03:36.451000",
      "created": "2025-07-06T20:41:53.748000",
      "tags": [
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "showing",
        "entries",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "ipv4",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "indicators show",
        "search",
        "reputation",
        "et att",
        "ck id",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "scan",
        "iocs",
        "learn more",
        "hostname",
        "types of",
        "pagehrsappjbpst",
        "actionu",
        "focusapplicant",
        "siteid1",
        "postingseq1",
        "t1036",
        "t1043",
        "port",
        "t1085",
        "rundll32",
        "t1114",
        "t1179",
        "fbi flash",
        "cu000163mw",
        "compromise",
        "found",
        "uunet",
        "code",
        "reverse domain",
        "lookup",
        "ragnar",
        "locker",
        "ragnar locker",
        "cidr",
        "pulses",
        "types",
        "windows",
        "linux",
        "united",
        "trojandropper",
        "mtb jun",
        "trojan",
        "win32upatre aug",
        "mtb may",
        "gmt server",
        "ecacc",
        "files",
        "suspicious",
        "body",
        "data upload",
        "extraction",
        "cve cve20170147",
        "cve cve20178570",
        "cve cve20178977",
        "url feb",
        "pulses hostname",
        "a1sticas",
        "next associated",
        "present mar",
        "present jun",
        "present may",
        "france",
        "date",
        "ip address",
        "present apr",
        "virtool",
        "name servers",
        "value emails",
        "name john",
        "shipton",
        "dynadot privacy",
        "po box",
        "city san",
        "mateo country",
        "us creation",
        "news videos",
        "maps assist",
        "search settings",
        "safe search",
        "date more",
        "images bae",
        "systems defense",
        "bae systems",
        "london",
        "britain",
        "akamai rank",
        "script urls",
        "status",
        "a domains",
        "accept encoding",
        "unknown ns",
        "meta",
        "encrypt",
        "https",
        "report spam",
        "created",
        "year ago",
        "modified",
        "octoseek public",
        "cyber attack",
        "pegasus",
        "westlaw",
        "hallrender",
        "front",
        "sabey",
        "enter s",
        "include review",
        "exclude sugges",
        "failed",
        "sc type",
        "extr included",
        "manually add",
        "puls",
        "excludedocs",
        "sugges data",
        "phishing",
        "apple pegasus",
        "detections",
        "references",
        "stranger things",
        "http",
        "yara",
        "upx alerts",
        "fort collins",
        "help4u",
        "communications",
        "orgtechhandle",
        "domain",
        "no entries",
        "cchk asnas26658",
        "vj92",
        "search filter",
        "time sabey",
        "x show",
        "indicator type",
        "email",
        "filehashimphash",
        "filehashpehash",
        "backdoor",
        "ransom",
        "checkin",
        "alphacrypt cnc",
        "beacon",
        "jeffrey scott",
        "terse http",
        "possible",
        "accept",
        "xorddos",
        "ck ids",
        "t1512",
        "camera",
        "t1071",
        "protocol",
        "ta0001",
        "access",
        "ta0002",
        "ta0003",
        "ta0004",
        "cookie",
        "show",
        "ally",
        "melika",
        "part1",
        "trojanclicker",
        "bayrob",
        "android",
        "ransomware",
        "sakula rat",
        "t1125",
        "video capture",
        "t1566",
        "t1068",
        "t1190",
        "application",
        "t1472",
        "t1457",
        "media content",
        "social media",
        "doppelgnging",
        "t1080",
        "shared content",
        "t1449",
        "exploit ss7",
        "phone callssms",
        "enter sc",
        "type",
        "no expiration",
        "expiration",
        "months ago",
        "expiration http",
        "reimer dpt",
        "r role",
        "sa victim",
        "daisy coleman",
        "source",
        "weeks ago",
        "tbmvid",
        "sourcelnms",
        "zx1724209326040",
        "ahtrnaah typ",
        "url url",
        "url domain",
        "pulse sthow",
        "ah types",
        "ind indicator",
        "data uptoad",
        "extrachttp",
        "dulce sphown",
        "aho data",
        "typ url",
        "url dom",
        "hos hostname",
        "hos host",
        "dom dom"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8149,
        "domain": 1067,
        "hostname": 2103,
        "FileHash-SHA256": 1617,
        "URI": 1,
        "FilePath": 1,
        "FileHash-MD5": 412,
        "FileHash-SHA1": 368,
        "CIDR": 4,
        "CVE": 6,
        "email": 10
      },
      "indicator_count": 13738,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "258 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "686c676bcc053e0fc51f01b2",
      "name": "ALL T8 research led to Firm_IP\u2019s = BoFa , WikiLeaks, United Healthcare, HCA, T-Mobile, Dish , AT&T,  Apple,+ Breaches despite other speculations with 0 relations",
      "description": "",
      "modified": "2025-08-05T15:03:36.451000",
      "created": "2025-07-08T00:33:47.021000",
      "tags": [
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "showing",
        "entries",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "ipv4",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "indicators show",
        "search",
        "reputation",
        "et att",
        "ck id",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "scan",
        "iocs",
        "learn more",
        "hostname",
        "types of",
        "pagehrsappjbpst",
        "actionu",
        "focusapplicant",
        "siteid1",
        "postingseq1",
        "t1036",
        "t1043",
        "port",
        "t1085",
        "rundll32",
        "t1114",
        "t1179",
        "fbi flash",
        "cu000163mw",
        "compromise",
        "found",
        "uunet",
        "code",
        "reverse domain",
        "lookup",
        "ragnar",
        "locker",
        "ragnar locker",
        "cidr",
        "pulses",
        "types",
        "windows",
        "linux",
        "united",
        "trojandropper",
        "mtb jun",
        "trojan",
        "win32upatre aug",
        "mtb may",
        "gmt server",
        "ecacc",
        "files",
        "suspicious",
        "body",
        "data upload",
        "extraction",
        "cve cve20170147",
        "cve cve20178570",
        "cve cve20178977",
        "url feb",
        "pulses hostname",
        "a1sticas",
        "next associated",
        "present mar",
        "present jun",
        "present may",
        "france",
        "date",
        "ip address",
        "present apr",
        "virtool",
        "name servers",
        "value emails",
        "name john",
        "shipton",
        "dynadot privacy",
        "po box",
        "city san",
        "mateo country",
        "us creation",
        "news videos",
        "maps assist",
        "search settings",
        "safe search",
        "date more",
        "images bae",
        "systems defense",
        "bae systems",
        "london",
        "britain",
        "akamai rank",
        "script urls",
        "status",
        "a domains",
        "accept encoding",
        "unknown ns",
        "meta",
        "encrypt",
        "https",
        "report spam",
        "created",
        "year ago",
        "modified",
        "octoseek public",
        "cyber attack",
        "pegasus",
        "westlaw",
        "hallrender",
        "front",
        "sabey",
        "enter s",
        "include review",
        "exclude sugges",
        "failed",
        "sc type",
        "extr included",
        "manually add",
        "puls",
        "excludedocs",
        "sugges data",
        "phishing",
        "apple pegasus",
        "detections",
        "references",
        "stranger things",
        "http",
        "yara",
        "upx alerts",
        "fort collins",
        "help4u",
        "communications",
        "orgtechhandle",
        "domain",
        "no entries",
        "cchk asnas26658",
        "vj92",
        "search filter",
        "time sabey",
        "x show",
        "indicator type",
        "email",
        "filehashimphash",
        "filehashpehash",
        "backdoor",
        "ransom",
        "checkin",
        "alphacrypt cnc",
        "beacon",
        "jeffrey scott",
        "terse http",
        "possible",
        "accept",
        "xorddos",
        "ck ids",
        "t1512",
        "camera",
        "t1071",
        "protocol",
        "ta0001",
        "access",
        "ta0002",
        "ta0003",
        "ta0004",
        "cookie",
        "show",
        "ally",
        "melika",
        "part1",
        "trojanclicker",
        "bayrob",
        "android",
        "ransomware",
        "sakula rat",
        "t1125",
        "video capture",
        "t1566",
        "t1068",
        "t1190",
        "application",
        "t1472",
        "t1457",
        "media content",
        "social media",
        "doppelgnging",
        "t1080",
        "shared content",
        "t1449",
        "exploit ss7",
        "phone callssms",
        "enter sc",
        "type",
        "no expiration",
        "expiration",
        "months ago",
        "expiration http",
        "reimer dpt",
        "r role",
        "sa victim",
        "daisy coleman",
        "source",
        "weeks ago",
        "tbmvid",
        "sourcelnms",
        "zx1724209326040",
        "ahtrnaah typ",
        "url url",
        "url domain",
        "pulse sthow",
        "ah types",
        "ind indicator",
        "data uptoad",
        "extrachttp",
        "dulce sphown",
        "aho data",
        "typ url",
        "url dom",
        "hos hostname",
        "hos host",
        "dom dom"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1085",
          "name": "Rundll32",
          "display_name": "T1085 - Rundll32"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1051",
          "name": "Shared Webroot",
          "display_name": "T1051 - Shared Webroot"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1506",
          "name": "Web Session Cookie",
          "display_name": "T1506 - Web Session Cookie"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "686adf91f725a8b7f9850192",
      "export_count": 56,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8149,
        "domain": 1067,
        "hostname": 2103,
        "FileHash-SHA256": 1617,
        "URI": 1,
        "FilePath": 1,
        "FileHash-MD5": 412,
        "FileHash-SHA1": 368,
        "CIDR": 4,
        "CVE": 6,
        "email": 10
      },
      "indicator_count": 13738,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "258 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "778 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655650c9b2be6cc930c92cf3",
      "name": "https://myaccount.uscis.gov/",
      "description": "HOW!?!? My device was remotely logged into this account somehow.\nThis is egregious. Silence  Threats. I have no connection to this but was contacted by a while ago. I don't know how or why a part of the government would attack a person with a TBI and C1 - S1 Spinal cord injury allegedly caused by Colorado physical therapist and protect him. Why  is victim, tracked and unsafe, receiving death threats, monitored, denied medical care, stalked EVERYWHERE.   \nEven felons aren't monitored for life. STOP.\nWill this get us killed. Do the right thing.\nGod bless America, purge the government.\nThe truth should set you fee not get you harmed.",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:26:33",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 102,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655652f6ddcbf952a599cded",
      "name": "https://myaccount.uscis.gov/",
      "description": "After Mark Montano Md reported alleged acts by Jeffrey Scott Reimer after receiving 'multiple' reports of him aggressively pursuing Brashears, she was contacted, told she violated the Patriot Act by Big O Tires?!! Received letters from the above and harassed for years. Colorado Workers compensation is so corrupt this may be my last post. She was immediately framed , blamed, porn smeared and stalked. Denied medical care , when received died on surgery table, revised and disabled. Even the mafia would  tackle only the associates bringing undue negative attention to their  own organization.",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:35:50.285000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 100,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65565477da453c46f05a6ac4",
      "name": "BTW VirusTotal - \" interesting files written to disk during execution'",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:42:15.123000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 101,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655657ca2e402d4f98283de9",
      "name": "https://myaccount.uscis.gov/ ",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:56:26.312000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 100,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655686e2c072557f03e9cba2",
      "name": "https://myaccount.uscis.gov/                         [pulse created by Octoseek]",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T21:17:22.087000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 102,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65580c52bf98f256b6a01da6",
      "name": "https://myaccount.uscis.gov/",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-18T00:58:58.944000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 101,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656aac25a8a2caaddf0d3b88",
      "name": "https://myaccount.uscis.gov/",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-12-02T04:01:41.427000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655652f6ddcbf952a599cded",
      "export_count": 93,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "856 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.jennbilton.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.jennbilton.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776718195.5298169
}