{
  "type": "URL",
  "indicator": "https://www.macintoshsoftware.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.macintoshsoftware.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3815587582,
      "indicator": "https://www.macintoshsoftware.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6910cafb096eae0dcb39a800",
          "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious",
          "description": "Chronicles of how  quasi government , a State owned criminal defense attorney , protects sexual assaulter Jeffrey Reimer DPT.   victim Palantir harassed, withheld healthcare , diagnoses, justice, monetary award for injured, stole insurance policies, hacked Denver artists, sold music her to artists whom profited, hacked  Denver music studios, hired stalkers, human, controlled phone , car and everything in targets life including , doctors, attorneys, hospitals. It\u2019s always been clear to coming us that Anonymous and Lazarus are the police, judge , lawyer, ransom racist.\nThis group alone has cost the US billions! Responsible for 2014 Sony hack , FMOE.\nDirect Link. by phone , email in person contact , forced settlement hearing,. Adversarial Christopher P. Ahmann , relationship w / Lazarus group, hitmen , cyber crime and other crimes against persons.\n #rip #christopher_ahmann #palantir #lazarus #target_tsara_brashears",
          "modified": "2025-12-09T17:03:48.645000",
          "created": "2025-11-09T17:10:19.498000",
          "tags": [
            "url http",
            "apple",
            "california",
            "apple public",
            "server rsa",
            "organization",
            "stateprovince",
            "ocsp",
            "nids united",
            "files",
            "united",
            "unknown ns",
            "ip address",
            "domain",
            "urls files",
            "passive dns",
            "found title",
            "sf hello",
            "myriad set",
            "pro myriad",
            "set lucida",
            "grande arial",
            "sf mono",
            "ipv4",
            "location united",
            "america flag",
            "america asn",
            "verdict",
            "files ip",
            "address",
            "as42 woodynet",
            "domain add",
            "ipv4 add",
            "reverse dns",
            "trojan",
            "name servers",
            "emails",
            "for privacy",
            "ltd dba",
            "com laude",
            "servers",
            "expiration date",
            "urls",
            "meta",
            "a domains",
            "country code",
            "store home",
            "title",
            "accept",
            "espaol",
            "english",
            "evil corp",
            "see all",
            "cyber hack",
            "republic",
            "canada",
            "season",
            "joe tidy",
            "sarah rainsford",
            "podcast",
            "bank",
            "ukraine",
            "dead",
            "indonesia",
            "police",
            "premium",
            "napoleon",
            "revolution",
            "michelangelo",
            "mozart",
            "global",
            "solid",
            "lazarus",
            "jabber zeus",
            "harrods",
            "ta markmonitor",
            "markmonitor",
            "search",
            "present aug",
            "unknown aaaa",
            "unknown soa",
            "win32",
            "invalid url",
            "trojanspy",
            "mtb apr",
            "backdoor",
            "next associated",
            "win64",
            "trojandropper",
            "twitter",
            "virtool",
            "ransom",
            "worm",
            "dynamicloader",
            "tlsv1",
            "high",
            "globalc",
            "medium",
            "windows",
            "cmd c",
            "delete c",
            "stream",
            "write",
            "next",
            "process32nextw",
            "http host",
            "dns query",
            "likely gandcrab",
            "et trojan",
            "windows nt",
            "wow64",
            "malware",
            "ms windows",
            "as16509",
            "as54113",
            "yara rule",
            "pe32 executable",
            "as15169",
            "powershell",
            "unknown",
            "response ip",
            "address google",
            "safe browsing",
            "hostname add",
            "port",
            "destination",
            "pe32",
            "intel",
            "error",
            "show",
            "delphi",
            "dcom",
            "form",
            "canvas",
            "united kingdom",
            "content type",
            "security",
            "moved",
            "great britain",
            "unknown a",
            "body doctype",
            "html public",
            "ietfdtd html",
            "showing",
            "packing t1045",
            "bytes",
            "read",
            "default",
            "christoper p ahmann",
            "target",
            "victims",
            "tsara brashears",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "present nov",
            "present oct",
            "date",
            "tcpmemhit",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "palantir",
            "foundry",
            "hitmen",
            "quasi",
            "government contracts",
            "jeffrey reimer",
            "hallrender",
            "workers compensation",
            "record value",
            "certificate"
          ],
          "references": [
            "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
            "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "bpc-old.palantirfoundry.com",
            "OTX auto populated  targeted groups.",
            "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
            "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
            "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
            "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
            "They blatantly steal from citizens , blame foreign entities.",
            "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
          ],
          "public": 1,
          "adversary": "Lazarus",
          "targeted_countries": [
            "Bangladesh",
            "Japan",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:SpikeAexR.PEVPSZL",
              "display_name": "ALF:SpikeAexR.PEVPSZL",
              "target": null
            },
            {
              "id": "Ransom:MSIL/GandCrab",
              "display_name": "Ransom:MSIL/GandCrab",
              "target": "/malware/Ransom:MSIL/GandCrab"
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Ransom:Win32/Gandcrab.H!MTB",
              "display_name": "Ransom:Win32/Gandcrab.H!MTB",
              "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [
            "Banks",
            "Crypto",
            "Entertainment",
            "Bank"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4572,
            "FileHash-MD5": 196,
            "domain": 1523,
            "hostname": 1393,
            "FileHash-SHA256": 2400,
            "FileHash-SHA1": 175,
            "email": 18,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 10285,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "131 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69138a8144a8bf8040a92711",
          "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Counsel for egregious criminal acts \u2022 Christopher P. Ahmann attorney at Large",
          "description": "",
          "modified": "2025-12-09T17:03:48.645000",
          "created": "2025-11-11T19:12:01.843000",
          "tags": [
            "url http",
            "apple",
            "california",
            "apple public",
            "server rsa",
            "organization",
            "stateprovince",
            "ocsp",
            "nids united",
            "files",
            "united",
            "unknown ns",
            "ip address",
            "domain",
            "urls files",
            "passive dns",
            "found title",
            "sf hello",
            "myriad set",
            "pro myriad",
            "set lucida",
            "grande arial",
            "sf mono",
            "ipv4",
            "location united",
            "america flag",
            "america asn",
            "verdict",
            "files ip",
            "address",
            "as42 woodynet",
            "domain add",
            "ipv4 add",
            "reverse dns",
            "trojan",
            "name servers",
            "emails",
            "for privacy",
            "ltd dba",
            "com laude",
            "servers",
            "expiration date",
            "urls",
            "meta",
            "a domains",
            "country code",
            "store home",
            "title",
            "accept",
            "espaol",
            "english",
            "evil corp",
            "see all",
            "cyber hack",
            "republic",
            "canada",
            "season",
            "joe tidy",
            "sarah rainsford",
            "podcast",
            "bank",
            "ukraine",
            "dead",
            "indonesia",
            "police",
            "premium",
            "napoleon",
            "revolution",
            "michelangelo",
            "mozart",
            "global",
            "solid",
            "lazarus",
            "jabber zeus",
            "harrods",
            "ta markmonitor",
            "markmonitor",
            "search",
            "present aug",
            "unknown aaaa",
            "unknown soa",
            "win32",
            "invalid url",
            "trojanspy",
            "mtb apr",
            "backdoor",
            "next associated",
            "win64",
            "trojandropper",
            "twitter",
            "virtool",
            "ransom",
            "worm",
            "dynamicloader",
            "tlsv1",
            "high",
            "globalc",
            "medium",
            "windows",
            "cmd c",
            "delete c",
            "stream",
            "write",
            "next",
            "process32nextw",
            "http host",
            "dns query",
            "likely gandcrab",
            "et trojan",
            "windows nt",
            "wow64",
            "malware",
            "ms windows",
            "as16509",
            "as54113",
            "yara rule",
            "pe32 executable",
            "as15169",
            "powershell",
            "unknown",
            "response ip",
            "address google",
            "safe browsing",
            "hostname add",
            "port",
            "destination",
            "pe32",
            "intel",
            "error",
            "show",
            "delphi",
            "dcom",
            "form",
            "canvas",
            "united kingdom",
            "content type",
            "security",
            "moved",
            "great britain",
            "unknown a",
            "body doctype",
            "html public",
            "ietfdtd html",
            "showing",
            "packing t1045",
            "bytes",
            "read",
            "default",
            "christoper p ahmann",
            "target",
            "victims",
            "tsara brashears",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "present nov",
            "present oct",
            "date",
            "tcpmemhit",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "palantir",
            "foundry",
            "hitmen",
            "quasi",
            "government contracts",
            "jeffrey reimer",
            "hallrender",
            "workers compensation",
            "record value",
            "certificate"
          ],
          "references": [
            "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
            "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "bpc-old.palantirfoundry.com",
            "OTX auto populated  targeted groups.",
            "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
            "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
            "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
            "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
            "They blatantly steal from citizens , blame foreign entities.",
            "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
          ],
          "public": 1,
          "adversary": "Lazarus",
          "targeted_countries": [
            "Bangladesh",
            "Japan",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:SpikeAexR.PEVPSZL",
              "display_name": "ALF:SpikeAexR.PEVPSZL",
              "target": null
            },
            {
              "id": "Ransom:MSIL/GandCrab",
              "display_name": "Ransom:MSIL/GandCrab",
              "target": "/malware/Ransom:MSIL/GandCrab"
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Ransom:Win32/Gandcrab.H!MTB",
              "display_name": "Ransom:Win32/Gandcrab.H!MTB",
              "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [
            "Banks",
            "Crypto",
            "Entertainment",
            "Bank"
          ],
          "TLP": "white",
          "cloned_from": "6910cafb096eae0dcb39a800",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4572,
            "FileHash-MD5": 196,
            "domain": 1523,
            "hostname": 1393,
            "FileHash-SHA256": 2400,
            "FileHash-SHA1": 175,
            "email": 18,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 10285,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "131 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659261d5965b4824d1606cf9",
          "name": "Pegasus - a-poster.info",
          "description": "",
          "modified": "2024-01-31T04:00:35.757000",
          "created": "2024-01-01T06:55:17.262000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "ipv4",
            "expiration",
            "iocs",
            "ipv6",
            "url http",
            "url https",
            "next",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "cidr",
            "pcap",
            "stix",
            "subid",
            "mtsub26293293",
            "dashboard",
            "browse scan",
            "endpoints all",
            "octoseek",
            "a poster",
            "apple",
            "apple id",
            "apple engineering",
            "icloud",
            "tulach",
            "hallrender",
            "ck matrix",
            "ck id",
            "xobo",
            "a nxdomain",
            "sabey",
            "aaaa",
            "win32",
            "briansabey",
            "brian",
            "brian sabey",
            "urls https",
            "unknown urls",
            "united",
            "ttl value",
            "tsara brashears",
            "trojan",
            "tracker",
            "tofsee",
            "threat analyzer",
            "threat",
            "temp",
            "teams api",
            "subdomains",
            "active",
            "active threat",
            "strings",
            "status codes",
            "japan national police agency",
            "pegasus",
            "china",
            "aig",
            "ssl certificate",
            "accept",
            "ssh on server",
            "speakez securus",
            "show technique",
            "https",
            "relay",
            "state",
            "android",
            "address",
            "aposter",
            "workaposter",
            "sha256",
            "showing",
            "simple",
            "span",
            "small",
            "serving ip",
            "script",
            "search",
            "root",
            "ca",
            "samples",
            "root ca",
            "resolutions",
            "remote",
            "relay",
            "relacion",
            "referrer",
            "record value",
            "applenoc",
            "as16625",
            "attack",
            "apple attack",
            "bundled",
            "canvas",
            "mitre attk",
            "brute force passwords",
            "body length",
            "body",
            "backdoor",
            "bellsouth",
            "bahamut",
            "bell south",
            "mitre",
            "cellbrite",
            "class",
            "click",
            "authority",
            "contentencoding",
            "akamai",
            "as20940",
            "as24940 hetzner",
            "as58061 scalaxy",
            "scalaxy",
            "as714",
            "critical",
            "communicating",
            "quasar",
            "trojan",
            "et",
            "icefog",
            "pegasus",
            "tofsee",
            "cmd",
            "crypto",
            "error",
            "dns replication",
            "domain entries",
            "et cins",
            "execution",
            "cname",
            "config",
            "contact",
            "contacted",
            "copy",
            "creation date",
            "formbook",
            "jekyll",
            "graph",
            "germany unknown",
            "generator",
            "general",
            "forbidden",
            "falcon sandbox",
            "ssl hostname",
            "false",
            "file",
            "final url",
            "final url summary",
            "hashes files",
            "headers nel",
            "historical",
            "malicious host",
            "malvertizing",
            "malware",
            "tagging",
            "contextualizing",
            "localappdata",
            "install",
            "installer",
            "ioc search",
            "iocs kb",
            "body",
            "local",
            "United states",
            "name",
            "name servers",
            "mitre att",
            "metro",
            "meta",
            "mail spammer",
            "submit",
            "submit quasar",
            "phishing",
            "pattern match",
            "paste",
            "passive dns",
            "nxdomain",
            "national police agency japan",
            "network",
            "verdict",
            "cmd",
            "sandbox",
            "http response",
            "record type",
            "phishing",
            "nuance",
            "next",
            "new ioc",
            "subdomains",
            "germany",
            "reinsurance",
            "nuance",
            "cybercrime",
            "tracking",
            "cyber stalking",
            "fear",
            "masquerading",
            "cobalt strike"
          ],
          "references": [
            "a-poster.info",
            "https://tulach.cc/",
            "images.ctfassets.net",
            "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
            "nr-data.net [Apple Private Data Collection]",
            "http://gmpg.org/xfn/11 [HTTrack]",
            "192.229.211.108 [Tracking & Virus Network]",
            "me.com [Pegasus]",
            "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
            "37.1.217.172 [scanning host]",
            "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4719,
            "domain": 2497,
            "hostname": 3549,
            "FileHash-MD5": 4118,
            "FileHash-SHA1": 3496,
            "FileHash-SHA256": 5861,
            "CIDR": 12,
            "email": 17
          },
          "indicator_count": 24269,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659261e2290ac1ecc5d9ca74",
          "name": "Pegasus - a-poster.info",
          "description": "",
          "modified": "2024-01-31T04:00:35.757000",
          "created": "2024-01-01T06:55:30.771000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "ipv4",
            "expiration",
            "iocs",
            "ipv6",
            "url http",
            "url https",
            "next",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "cidr",
            "pcap",
            "stix",
            "subid",
            "mtsub26293293",
            "dashboard",
            "browse scan",
            "endpoints all",
            "octoseek",
            "a poster",
            "apple",
            "apple id",
            "apple engineering",
            "icloud",
            "tulach",
            "hallrender",
            "ck matrix",
            "ck id",
            "xobo",
            "a nxdomain",
            "sabey",
            "aaaa",
            "win32",
            "briansabey",
            "brian",
            "brian sabey",
            "urls https",
            "unknown urls",
            "united",
            "ttl value",
            "tsara brashears",
            "trojan",
            "tracker",
            "tofsee",
            "threat analyzer",
            "threat",
            "temp",
            "teams api",
            "subdomains",
            "active",
            "active threat",
            "strings",
            "status codes",
            "japan national police agency",
            "pegasus",
            "china",
            "aig",
            "ssl certificate",
            "accept",
            "ssh on server",
            "speakez securus",
            "show technique",
            "https",
            "relay",
            "state",
            "android",
            "address",
            "aposter",
            "workaposter",
            "sha256",
            "showing",
            "simple",
            "span",
            "small",
            "serving ip",
            "script",
            "search",
            "root",
            "ca",
            "samples",
            "root ca",
            "resolutions",
            "remote",
            "relay",
            "relacion",
            "referrer",
            "record value",
            "applenoc",
            "as16625",
            "attack",
            "apple attack",
            "bundled",
            "canvas",
            "mitre attk",
            "brute force passwords",
            "body length",
            "body",
            "backdoor",
            "bellsouth",
            "bahamut",
            "bell south",
            "mitre",
            "cellbrite",
            "class",
            "click",
            "authority",
            "contentencoding",
            "akamai",
            "as20940",
            "as24940 hetzner",
            "as58061 scalaxy",
            "scalaxy",
            "as714",
            "critical",
            "communicating",
            "quasar",
            "trojan",
            "et",
            "icefog",
            "pegasus",
            "tofsee",
            "cmd",
            "crypto",
            "error",
            "dns replication",
            "domain entries",
            "et cins",
            "execution",
            "cname",
            "config",
            "contact",
            "contacted",
            "copy",
            "creation date",
            "formbook",
            "jekyll",
            "graph",
            "germany unknown",
            "generator",
            "general",
            "forbidden",
            "falcon sandbox",
            "ssl hostname",
            "false",
            "file",
            "final url",
            "final url summary",
            "hashes files",
            "headers nel",
            "historical",
            "malicious host",
            "malvertizing",
            "malware",
            "tagging",
            "contextualizing",
            "localappdata",
            "install",
            "installer",
            "ioc search",
            "iocs kb",
            "body",
            "local",
            "United states",
            "name",
            "name servers",
            "mitre att",
            "metro",
            "meta",
            "mail spammer",
            "submit",
            "submit quasar",
            "phishing",
            "pattern match",
            "paste",
            "passive dns",
            "nxdomain",
            "national police agency japan",
            "network",
            "verdict",
            "cmd",
            "sandbox",
            "http response",
            "record type",
            "phishing",
            "nuance",
            "next",
            "new ioc",
            "subdomains",
            "germany",
            "reinsurance",
            "nuance",
            "cybercrime",
            "tracking",
            "cyber stalking",
            "fear",
            "masquerading",
            "cobalt strike"
          ],
          "references": [
            "a-poster.info",
            "https://tulach.cc/",
            "images.ctfassets.net",
            "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
            "nr-data.net [Apple Private Data Collection]",
            "http://gmpg.org/xfn/11 [HTTrack]",
            "192.229.211.108 [Tracking & Virus Network]",
            "me.com [Pegasus]",
            "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
            "37.1.217.172 [scanning host]",
            "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4695,
            "domain": 2494,
            "hostname": 3547,
            "FileHash-MD5": 4118,
            "FileHash-SHA1": 3496,
            "FileHash-SHA256": 5841,
            "CIDR": 12,
            "email": 17
          },
          "indicator_count": 24220,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658f967a4fc7ebe8021b9382",
          "name": "Mirai Apple Attack +",
          "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-30T04:03:06.598000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659127f3265ec6306b607faa",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-31T08:36:03.380000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65944b9812ea52ab41c0259d",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2024-01-02T17:44:56.709000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86",
        "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "a-poster.info",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
        "They blatantly steal from citizens , blame foreign entities.",
        "images.ctfassets.net",
        "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
        "https://tulach.cc/",
        "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
        "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
        "me.com [Pegasus]",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents.",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "00000000.apple.com  | remote SIM Swap",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "https://twitter.com/PORNO_SEXYBABES",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "nr-data.net | Apple Private Data collection",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "37.1.217.172 [scanning host]",
        "103.246.145.111  - scanning host",
        "192.229.211.108 [Tracking & Virus Network]",
        "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
        "OTX auto populated  targeted groups.",
        "103.246.145.111 phishing",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "nr-data.net [Apple Private Data Collection]",
        "bpc-old.palantirfoundry.com",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "http://gmpg.org/xfn/11 [HTTrack]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Lazarus"
          ],
          "malware_families": [
            "Pegasus for ios - s0289",
            "Ransom:msil/gandcrab",
            "Trojan",
            "Formbook",
            "Ransom:win32/gandcrab.h!mtb",
            "Ratel",
            "Sabey",
            "Pegasus for android - mob-s0032",
            "Hallrender",
            "Appleservice",
            "Tulach",
            "Icefog",
            "Zeus",
            "Other malware",
            "Cobalt strike",
            "Alf:spikeaexr.pevpszl",
            "Pegasus - mob-s0005",
            "Trojan.mirai/genericrxui",
            "Quasar rat",
            "Tofsee"
          ],
          "industries": [
            "Banks",
            "Entertainment",
            "Healthcare",
            "Crypto",
            "Bank"
          ],
          "unique_indicators": 51529
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/macintoshsoftware.com",
    "whois": "http://whois.domaintools.com/macintoshsoftware.com",
    "domain": "macintoshsoftware.com",
    "hostname": "www.macintoshsoftware.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6910cafb096eae0dcb39a800",
      "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious",
      "description": "Chronicles of how  quasi government , a State owned criminal defense attorney , protects sexual assaulter Jeffrey Reimer DPT.   victim Palantir harassed, withheld healthcare , diagnoses, justice, monetary award for injured, stole insurance policies, hacked Denver artists, sold music her to artists whom profited, hacked  Denver music studios, hired stalkers, human, controlled phone , car and everything in targets life including , doctors, attorneys, hospitals. It\u2019s always been clear to coming us that Anonymous and Lazarus are the police, judge , lawyer, ransom racist.\nThis group alone has cost the US billions! Responsible for 2014 Sony hack , FMOE.\nDirect Link. by phone , email in person contact , forced settlement hearing,. Adversarial Christopher P. Ahmann , relationship w / Lazarus group, hitmen , cyber crime and other crimes against persons.\n #rip #christopher_ahmann #palantir #lazarus #target_tsara_brashears",
      "modified": "2025-12-09T17:03:48.645000",
      "created": "2025-11-09T17:10:19.498000",
      "tags": [
        "url http",
        "apple",
        "california",
        "apple public",
        "server rsa",
        "organization",
        "stateprovince",
        "ocsp",
        "nids united",
        "files",
        "united",
        "unknown ns",
        "ip address",
        "domain",
        "urls files",
        "passive dns",
        "found title",
        "sf hello",
        "myriad set",
        "pro myriad",
        "set lucida",
        "grande arial",
        "sf mono",
        "ipv4",
        "location united",
        "america flag",
        "america asn",
        "verdict",
        "files ip",
        "address",
        "as42 woodynet",
        "domain add",
        "ipv4 add",
        "reverse dns",
        "trojan",
        "name servers",
        "emails",
        "for privacy",
        "ltd dba",
        "com laude",
        "servers",
        "expiration date",
        "urls",
        "meta",
        "a domains",
        "country code",
        "store home",
        "title",
        "accept",
        "espaol",
        "english",
        "evil corp",
        "see all",
        "cyber hack",
        "republic",
        "canada",
        "season",
        "joe tidy",
        "sarah rainsford",
        "podcast",
        "bank",
        "ukraine",
        "dead",
        "indonesia",
        "police",
        "premium",
        "napoleon",
        "revolution",
        "michelangelo",
        "mozart",
        "global",
        "solid",
        "lazarus",
        "jabber zeus",
        "harrods",
        "ta markmonitor",
        "markmonitor",
        "search",
        "present aug",
        "unknown aaaa",
        "unknown soa",
        "win32",
        "invalid url",
        "trojanspy",
        "mtb apr",
        "backdoor",
        "next associated",
        "win64",
        "trojandropper",
        "twitter",
        "virtool",
        "ransom",
        "worm",
        "dynamicloader",
        "tlsv1",
        "high",
        "globalc",
        "medium",
        "windows",
        "cmd c",
        "delete c",
        "stream",
        "write",
        "next",
        "process32nextw",
        "http host",
        "dns query",
        "likely gandcrab",
        "et trojan",
        "windows nt",
        "wow64",
        "malware",
        "ms windows",
        "as16509",
        "as54113",
        "yara rule",
        "pe32 executable",
        "as15169",
        "powershell",
        "unknown",
        "response ip",
        "address google",
        "safe browsing",
        "hostname add",
        "port",
        "destination",
        "pe32",
        "intel",
        "error",
        "show",
        "delphi",
        "dcom",
        "form",
        "canvas",
        "united kingdom",
        "content type",
        "security",
        "moved",
        "great britain",
        "unknown a",
        "body doctype",
        "html public",
        "ietfdtd html",
        "showing",
        "packing t1045",
        "bytes",
        "read",
        "default",
        "christoper p ahmann",
        "target",
        "victims",
        "tsara brashears",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "present nov",
        "present oct",
        "date",
        "tcpmemhit",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "palantir",
        "foundry",
        "hitmen",
        "quasi",
        "government contracts",
        "jeffrey reimer",
        "hallrender",
        "workers compensation",
        "record value",
        "certificate"
      ],
      "references": [
        "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
        "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "bpc-old.palantirfoundry.com",
        "OTX auto populated  targeted groups.",
        "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
        "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
        "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
        "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
        "They blatantly steal from citizens , blame foreign entities.",
        "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
      ],
      "public": 1,
      "adversary": "Lazarus",
      "targeted_countries": [
        "Bangladesh",
        "Japan",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:SpikeAexR.PEVPSZL",
          "display_name": "ALF:SpikeAexR.PEVPSZL",
          "target": null
        },
        {
          "id": "Ransom:MSIL/GandCrab",
          "display_name": "Ransom:MSIL/GandCrab",
          "target": "/malware/Ransom:MSIL/GandCrab"
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        },
        {
          "id": "Ransom:Win32/Gandcrab.H!MTB",
          "display_name": "Ransom:Win32/Gandcrab.H!MTB",
          "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [
        "Banks",
        "Crypto",
        "Entertainment",
        "Bank"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4572,
        "FileHash-MD5": 196,
        "domain": 1523,
        "hostname": 1393,
        "FileHash-SHA256": 2400,
        "FileHash-SHA1": 175,
        "email": 18,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 10285,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "131 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69138a8144a8bf8040a92711",
      "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Counsel for egregious criminal acts \u2022 Christopher P. Ahmann attorney at Large",
      "description": "",
      "modified": "2025-12-09T17:03:48.645000",
      "created": "2025-11-11T19:12:01.843000",
      "tags": [
        "url http",
        "apple",
        "california",
        "apple public",
        "server rsa",
        "organization",
        "stateprovince",
        "ocsp",
        "nids united",
        "files",
        "united",
        "unknown ns",
        "ip address",
        "domain",
        "urls files",
        "passive dns",
        "found title",
        "sf hello",
        "myriad set",
        "pro myriad",
        "set lucida",
        "grande arial",
        "sf mono",
        "ipv4",
        "location united",
        "america flag",
        "america asn",
        "verdict",
        "files ip",
        "address",
        "as42 woodynet",
        "domain add",
        "ipv4 add",
        "reverse dns",
        "trojan",
        "name servers",
        "emails",
        "for privacy",
        "ltd dba",
        "com laude",
        "servers",
        "expiration date",
        "urls",
        "meta",
        "a domains",
        "country code",
        "store home",
        "title",
        "accept",
        "espaol",
        "english",
        "evil corp",
        "see all",
        "cyber hack",
        "republic",
        "canada",
        "season",
        "joe tidy",
        "sarah rainsford",
        "podcast",
        "bank",
        "ukraine",
        "dead",
        "indonesia",
        "police",
        "premium",
        "napoleon",
        "revolution",
        "michelangelo",
        "mozart",
        "global",
        "solid",
        "lazarus",
        "jabber zeus",
        "harrods",
        "ta markmonitor",
        "markmonitor",
        "search",
        "present aug",
        "unknown aaaa",
        "unknown soa",
        "win32",
        "invalid url",
        "trojanspy",
        "mtb apr",
        "backdoor",
        "next associated",
        "win64",
        "trojandropper",
        "twitter",
        "virtool",
        "ransom",
        "worm",
        "dynamicloader",
        "tlsv1",
        "high",
        "globalc",
        "medium",
        "windows",
        "cmd c",
        "delete c",
        "stream",
        "write",
        "next",
        "process32nextw",
        "http host",
        "dns query",
        "likely gandcrab",
        "et trojan",
        "windows nt",
        "wow64",
        "malware",
        "ms windows",
        "as16509",
        "as54113",
        "yara rule",
        "pe32 executable",
        "as15169",
        "powershell",
        "unknown",
        "response ip",
        "address google",
        "safe browsing",
        "hostname add",
        "port",
        "destination",
        "pe32",
        "intel",
        "error",
        "show",
        "delphi",
        "dcom",
        "form",
        "canvas",
        "united kingdom",
        "content type",
        "security",
        "moved",
        "great britain",
        "unknown a",
        "body doctype",
        "html public",
        "ietfdtd html",
        "showing",
        "packing t1045",
        "bytes",
        "read",
        "default",
        "christoper p ahmann",
        "target",
        "victims",
        "tsara brashears",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "present nov",
        "present oct",
        "date",
        "tcpmemhit",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "palantir",
        "foundry",
        "hitmen",
        "quasi",
        "government contracts",
        "jeffrey reimer",
        "hallrender",
        "workers compensation",
        "record value",
        "certificate"
      ],
      "references": [
        "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
        "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "bpc-old.palantirfoundry.com",
        "OTX auto populated  targeted groups.",
        "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
        "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
        "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
        "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
        "They blatantly steal from citizens , blame foreign entities.",
        "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
      ],
      "public": 1,
      "adversary": "Lazarus",
      "targeted_countries": [
        "Bangladesh",
        "Japan",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:SpikeAexR.PEVPSZL",
          "display_name": "ALF:SpikeAexR.PEVPSZL",
          "target": null
        },
        {
          "id": "Ransom:MSIL/GandCrab",
          "display_name": "Ransom:MSIL/GandCrab",
          "target": "/malware/Ransom:MSIL/GandCrab"
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        },
        {
          "id": "Ransom:Win32/Gandcrab.H!MTB",
          "display_name": "Ransom:Win32/Gandcrab.H!MTB",
          "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [
        "Banks",
        "Crypto",
        "Entertainment",
        "Bank"
      ],
      "TLP": "white",
      "cloned_from": "6910cafb096eae0dcb39a800",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4572,
        "FileHash-MD5": 196,
        "domain": 1523,
        "hostname": 1393,
        "FileHash-SHA256": 2400,
        "FileHash-SHA1": 175,
        "email": 18,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 10285,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "131 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659261d5965b4824d1606cf9",
      "name": "Pegasus - a-poster.info",
      "description": "",
      "modified": "2024-01-31T04:00:35.757000",
      "created": "2024-01-01T06:55:17.262000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "ipv4",
        "expiration",
        "iocs",
        "ipv6",
        "url http",
        "url https",
        "next",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "cidr",
        "pcap",
        "stix",
        "subid",
        "mtsub26293293",
        "dashboard",
        "browse scan",
        "endpoints all",
        "octoseek",
        "a poster",
        "apple",
        "apple id",
        "apple engineering",
        "icloud",
        "tulach",
        "hallrender",
        "ck matrix",
        "ck id",
        "xobo",
        "a nxdomain",
        "sabey",
        "aaaa",
        "win32",
        "briansabey",
        "brian",
        "brian sabey",
        "urls https",
        "unknown urls",
        "united",
        "ttl value",
        "tsara brashears",
        "trojan",
        "tracker",
        "tofsee",
        "threat analyzer",
        "threat",
        "temp",
        "teams api",
        "subdomains",
        "active",
        "active threat",
        "strings",
        "status codes",
        "japan national police agency",
        "pegasus",
        "china",
        "aig",
        "ssl certificate",
        "accept",
        "ssh on server",
        "speakez securus",
        "show technique",
        "https",
        "relay",
        "state",
        "android",
        "address",
        "aposter",
        "workaposter",
        "sha256",
        "showing",
        "simple",
        "span",
        "small",
        "serving ip",
        "script",
        "search",
        "root",
        "ca",
        "samples",
        "root ca",
        "resolutions",
        "remote",
        "relay",
        "relacion",
        "referrer",
        "record value",
        "applenoc",
        "as16625",
        "attack",
        "apple attack",
        "bundled",
        "canvas",
        "mitre attk",
        "brute force passwords",
        "body length",
        "body",
        "backdoor",
        "bellsouth",
        "bahamut",
        "bell south",
        "mitre",
        "cellbrite",
        "class",
        "click",
        "authority",
        "contentencoding",
        "akamai",
        "as20940",
        "as24940 hetzner",
        "as58061 scalaxy",
        "scalaxy",
        "as714",
        "critical",
        "communicating",
        "quasar",
        "trojan",
        "et",
        "icefog",
        "pegasus",
        "tofsee",
        "cmd",
        "crypto",
        "error",
        "dns replication",
        "domain entries",
        "et cins",
        "execution",
        "cname",
        "config",
        "contact",
        "contacted",
        "copy",
        "creation date",
        "formbook",
        "jekyll",
        "graph",
        "germany unknown",
        "generator",
        "general",
        "forbidden",
        "falcon sandbox",
        "ssl hostname",
        "false",
        "file",
        "final url",
        "final url summary",
        "hashes files",
        "headers nel",
        "historical",
        "malicious host",
        "malvertizing",
        "malware",
        "tagging",
        "contextualizing",
        "localappdata",
        "install",
        "installer",
        "ioc search",
        "iocs kb",
        "body",
        "local",
        "United states",
        "name",
        "name servers",
        "mitre att",
        "metro",
        "meta",
        "mail spammer",
        "submit",
        "submit quasar",
        "phishing",
        "pattern match",
        "paste",
        "passive dns",
        "nxdomain",
        "national police agency japan",
        "network",
        "verdict",
        "cmd",
        "sandbox",
        "http response",
        "record type",
        "phishing",
        "nuance",
        "next",
        "new ioc",
        "subdomains",
        "germany",
        "reinsurance",
        "nuance",
        "cybercrime",
        "tracking",
        "cyber stalking",
        "fear",
        "masquerading",
        "cobalt strike"
      ],
      "references": [
        "a-poster.info",
        "https://tulach.cc/",
        "images.ctfassets.net",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "nr-data.net [Apple Private Data Collection]",
        "http://gmpg.org/xfn/11 [HTTrack]",
        "192.229.211.108 [Tracking & Virus Network]",
        "me.com [Pegasus]",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "37.1.217.172 [scanning host]",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "IceFog",
          "display_name": "IceFog",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Pegasus for iOS - S0289",
          "display_name": "Pegasus for iOS - S0289",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Trojan",
          "display_name": "Trojan",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Appleservice",
          "display_name": "Appleservice",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 41,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4719,
        "domain": 2497,
        "hostname": 3549,
        "FileHash-MD5": 4118,
        "FileHash-SHA1": 3496,
        "FileHash-SHA256": 5861,
        "CIDR": 12,
        "email": 17
      },
      "indicator_count": 24269,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659261e2290ac1ecc5d9ca74",
      "name": "Pegasus - a-poster.info",
      "description": "",
      "modified": "2024-01-31T04:00:35.757000",
      "created": "2024-01-01T06:55:30.771000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "ipv4",
        "expiration",
        "iocs",
        "ipv6",
        "url http",
        "url https",
        "next",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "cidr",
        "pcap",
        "stix",
        "subid",
        "mtsub26293293",
        "dashboard",
        "browse scan",
        "endpoints all",
        "octoseek",
        "a poster",
        "apple",
        "apple id",
        "apple engineering",
        "icloud",
        "tulach",
        "hallrender",
        "ck matrix",
        "ck id",
        "xobo",
        "a nxdomain",
        "sabey",
        "aaaa",
        "win32",
        "briansabey",
        "brian",
        "brian sabey",
        "urls https",
        "unknown urls",
        "united",
        "ttl value",
        "tsara brashears",
        "trojan",
        "tracker",
        "tofsee",
        "threat analyzer",
        "threat",
        "temp",
        "teams api",
        "subdomains",
        "active",
        "active threat",
        "strings",
        "status codes",
        "japan national police agency",
        "pegasus",
        "china",
        "aig",
        "ssl certificate",
        "accept",
        "ssh on server",
        "speakez securus",
        "show technique",
        "https",
        "relay",
        "state",
        "android",
        "address",
        "aposter",
        "workaposter",
        "sha256",
        "showing",
        "simple",
        "span",
        "small",
        "serving ip",
        "script",
        "search",
        "root",
        "ca",
        "samples",
        "root ca",
        "resolutions",
        "remote",
        "relay",
        "relacion",
        "referrer",
        "record value",
        "applenoc",
        "as16625",
        "attack",
        "apple attack",
        "bundled",
        "canvas",
        "mitre attk",
        "brute force passwords",
        "body length",
        "body",
        "backdoor",
        "bellsouth",
        "bahamut",
        "bell south",
        "mitre",
        "cellbrite",
        "class",
        "click",
        "authority",
        "contentencoding",
        "akamai",
        "as20940",
        "as24940 hetzner",
        "as58061 scalaxy",
        "scalaxy",
        "as714",
        "critical",
        "communicating",
        "quasar",
        "trojan",
        "et",
        "icefog",
        "pegasus",
        "tofsee",
        "cmd",
        "crypto",
        "error",
        "dns replication",
        "domain entries",
        "et cins",
        "execution",
        "cname",
        "config",
        "contact",
        "contacted",
        "copy",
        "creation date",
        "formbook",
        "jekyll",
        "graph",
        "germany unknown",
        "generator",
        "general",
        "forbidden",
        "falcon sandbox",
        "ssl hostname",
        "false",
        "file",
        "final url",
        "final url summary",
        "hashes files",
        "headers nel",
        "historical",
        "malicious host",
        "malvertizing",
        "malware",
        "tagging",
        "contextualizing",
        "localappdata",
        "install",
        "installer",
        "ioc search",
        "iocs kb",
        "body",
        "local",
        "United states",
        "name",
        "name servers",
        "mitre att",
        "metro",
        "meta",
        "mail spammer",
        "submit",
        "submit quasar",
        "phishing",
        "pattern match",
        "paste",
        "passive dns",
        "nxdomain",
        "national police agency japan",
        "network",
        "verdict",
        "cmd",
        "sandbox",
        "http response",
        "record type",
        "phishing",
        "nuance",
        "next",
        "new ioc",
        "subdomains",
        "germany",
        "reinsurance",
        "nuance",
        "cybercrime",
        "tracking",
        "cyber stalking",
        "fear",
        "masquerading",
        "cobalt strike"
      ],
      "references": [
        "a-poster.info",
        "https://tulach.cc/",
        "images.ctfassets.net",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "nr-data.net [Apple Private Data Collection]",
        "http://gmpg.org/xfn/11 [HTTrack]",
        "192.229.211.108 [Tracking & Virus Network]",
        "me.com [Pegasus]",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "37.1.217.172 [scanning host]",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "IceFog",
          "display_name": "IceFog",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Pegasus for iOS - S0289",
          "display_name": "Pegasus for iOS - S0289",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Trojan",
          "display_name": "Trojan",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Appleservice",
          "display_name": "Appleservice",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4695,
        "domain": 2494,
        "hostname": 3547,
        "FileHash-MD5": 4118,
        "FileHash-SHA1": 3496,
        "FileHash-SHA256": 5841,
        "CIDR": 12,
        "email": 17
      },
      "indicator_count": 24220,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658f967a4fc7ebe8021b9382",
      "name": "Mirai Apple Attack +",
      "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2023-12-30T04:03:06.598000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659127f3265ec6306b607faa",
      "name": "Mirai Apple Attack +",
      "description": "",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2023-12-31T08:36:03.380000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658f967a4fc7ebe8021b9382",
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65944b9812ea52ab41c0259d",
      "name": "Mirai Apple Attack +",
      "description": "",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2024-01-02T17:44:56.709000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658f967a4fc7ebe8021b9382",
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.macintoshsoftware.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.macintoshsoftware.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776627789.6615546
}