{
  "type": "URL",
  "indicator": "https://www.p6f52khhc7a.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.p6f52khhc7a.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4173103148,
      "indicator": "https://www.p6f52khhc7a.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69bf261cc4e399447d78776c",
          "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
          "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
          "modified": "2026-04-20T21:01:07.869000",
          "created": "2026-03-21T23:13:32.760000",
          "tags": [
            "sc data",
            "data upload",
            "please sub",
            "include data",
            "extraction",
            "failed",
            "sc pulse",
            "idron anv",
            "extr please",
            "include review",
            "exclude sugges",
            "stop show",
            "typ domain",
            "united",
            "virtool",
            "name servers",
            "cryp",
            "emails",
            "win32",
            "ip address",
            "worm",
            "trojan",
            "learn",
            "suspicious",
            "informative",
            "ck id",
            "name tactics",
            "command",
            "adversaries",
            "spawns",
            "ssl certificate",
            "initial access",
            "link initial",
            "prefetch8",
            "mitre att",
            "ck matrix",
            "flag",
            "windows nt",
            "win64",
            "accept",
            "encrypt",
            "form",
            "hybrid",
            "bypass",
            "general",
            "path",
            "iframe",
            "click",
            "strings",
            "anchor https",
            "anchor",
            "liberal",
            "sabey",
            "liberal friends",
            "meta",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "info initial",
            "access ta0001",
            "compromise",
            "t1189 network",
            "communication",
            "get http",
            "artifacts v",
            "full reports",
            "v get",
            "help dns",
            "resolutions",
            "ip traffic",
            "extr data",
            "enter sc",
            "extra data",
            "referen",
            "broth",
            "passive dns",
            "urls",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "none google",
            "safe browsing",
            "inquest labs",
            "lucas acha",
            "code integrity",
            "checks creation",
            "otx logo",
            "all hostname",
            "files",
            "domain",
            "protect",
            "date",
            "title",
            "exchange",
            "se http",
            "present jan",
            "present feb",
            "present dec",
            "backdoor",
            "certificate",
            "all domain",
            "alibaba cloud",
            "hichina",
            "porkbun llc",
            "cloudflare",
            "namecheap inc",
            "namecheap",
            "domains",
            "dynadot llc",
            "ascio",
            "denmark",
            "url https",
            "filehashsha256",
            "url http",
            "dopple ai",
            "snit",
            "iocs",
            "otx description",
            "information",
            "report spam",
            "delete service",
            "poem",
            "hunter",
            "malicious",
            "porn revenge",
            "brian sabeys",
            "all report",
            "spam delete",
            "rl http",
            "https",
            "expiration http",
            "spam brian",
            "swipper",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashmd5",
            "filehashsha1",
            "sha256",
            "scan",
            "learn more",
            "indicators show",
            "tbmvid",
            "sourcelnms",
            "zx1724209326040",
            "xxx videos",
            "xxxvideohd",
            "adversary",
            "packing",
            "palantir.com",
            "discovery",
            "victim won case",
            "doin it",
            "palantirian abuse",
            "apple",
            "sabey data centers",
            "insurance",
            "quasi government",
            "the brother sabey",
            "reimer",
            "law enforcement",
            "vessel state",
            "sabey porn",
            "hall evans",
            "christopher ahmann",
            "defamation",
            "google"
          ],
          "references": [
            "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
            "http://watchhers.net/index.php",
            "http://212.33.237.86/images/1/report.php",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://webmail.police.govmm.org/owa/",
            "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
            "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
            "Mark Brian Sabey",
            "Melvin Sabey",
            "Christopher P \u2018Buzz\u2019 Ahmann",
            "Ronda Cordova",
            "Unknown Persons impersonating Private Investigators (plural)",
            "Quasi Government Case",
            "Victim silenced. Struck by Car Driven by male police let walk",
            "Denver Police let this attempted murder walk. Cited him as a ghost driver",
            "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
            "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
            "Reimer was a PT. Unknown whereabouts , name or job description",
            "Denver Police Department Major Crimes closed investigation",
            "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
            "I bring up the personal nature of the crime because a delete service has been used",
            "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
            "All IoC\u2019s originate from sources named. There are some unknown attackers",
            "This is a serious crime. I\u2019m certain God WILL pay them.",
            "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
            "http://palantirwww.sweetheartvideo.com/ (weirdness)",
            "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2-lbl.dvr.dn2.n-helix.com/",
            "https://207-207-25-201.fwd.datafoundry.com/",
            "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
            "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2sdbl.dvr.dn2.n-helix.com/",
            "Updated | What\u2019s left after theft",
            "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
            "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
            "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
            "https://www.datafoundry.com/category/news/press-releases/",
            "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
            "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
            "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
            "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
            "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
            "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
            "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
            "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
            "Some may may find this content is very disturbing and offensive"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Porn Revenge",
              "display_name": "Porn Revenge",
              "target": null
            },
            {
              "id": "Tons of Malware",
              "display_name": "Tons of Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1132.001",
              "name": "Standard Encoding",
              "display_name": "T1132.001 - Standard Encoding"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1495",
              "name": "Firmware Corruption",
              "display_name": "T1495 - Firmware Corruption"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6034,
            "domain": 1422,
            "FileHash-MD5": 274,
            "FileHash-SHA1": 252,
            "FileHash-SHA256": 3378,
            "email": 11,
            "hostname": 2753,
            "CVE": 1,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 14134,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "41 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6958372ef9da31513d96bebb",
          "name": "Connected-IOS remotely connected to 180.4.1.2 \u2022  ocn.ad.jp -NTT Communications Corporation",
          "description": "Retaliation? IOS remotely connected to 180.4.1.2 \u2022  ocn.ad.jp -NTT Communications Corporation for malicious control | found in the analytics of a highly target device: I\u2019ve included related pulses from 2 other threat responders and an Apple discussion post. Surprisingly, most of the IoC\u2019s pulsed came from one page of analytics. | \u2022 \"avconferenced\", \"procPath\" : \"\\/usr\\/libexec\\/avconferenced |  180.4.1.2 | a version of\npegasus found. | https://prometheus-pushgateway-internal.preview.tp-staging.com/\t\nhostname: prometheus.netmaker.vonnue.dev\t\nhostname: prometheus.dev.aws.finoa.io |\nSince Prometheus pulse . I realize now every Prometheus pulse illicits outrageous behavior.. Is this a secret society? Try to be more secretive. Owl heads in lawn. This behavior illicits investigation for a fix. Please STOP. I\u2019m done looking at Prometheus. Please stop leaving artifacts.",
          "modified": "2026-02-01T20:00:08.812000",
          "created": "2026-01-02T21:22:54.247000",
          "tags": [
            "syscall",
            "nsrunloop",
            "objcclass",
            "region type",
            "start",
            "vsize",
            "prtmax shrmod",
            "region detailn",
            "unused space",
            "at startn",
            "guard",
            "urls",
            "url analysis",
            "verdict",
            "domain",
            "address",
            "location japan",
            "hikone",
            "japan asn",
            "as4713 ntt",
            "related tags",
            "none external",
            "aaaa",
            "united",
            "passive dns",
            "ip address",
            "japan",
            "present dec",
            "domain add",
            "files",
            "japan unknown",
            "present jul",
            "present oct",
            "present sep",
            "present aug",
            "present jun",
            "japan showing",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "reverse dns",
            "present nov",
            "present",
            "present may",
            "present mar",
            "present apr",
            "data upload",
            "extraction",
            "failed",
            "files ip",
            "moved",
            "gmt content",
            "ipv4 add",
            "location united",
            "title",
            "ipv4",
            "dns resolutions",
            "hostname add",
            "asn as4713",
            "all ipv4",
            "google",
            "ocn ntt",
            "googlecl",
            "http",
            "amazon02",
            "akamaias",
            "page url",
            "yahoojp",
            "december",
            "jp summary",
            "february",
            "asn15169",
            "tokyo",
            "kansas city",
            "asn396982",
            "asn30286",
            "asn16509",
            "cisco",
            "umbrella rank",
            "cisco umbrella",
            "rank",
            "kitashinagawa",
            "sureserver ev",
            "ca g3",
            "domains",
            "hashes",
            "microsoft",
            "docomo business",
            "ml14325",
            "as autonomous",
            "asn8075",
            "ip information",
            "ipasns ip",
            "detail domain",
            "domain tree",
            "links domain",
            "requested",
            "value",
            "automatic",
            "webgl",
            "please",
            "mr value",
            "muid value",
            "mjl function",
            "dcmlinker",
            "paq string",
            "kb script",
            "b image",
            "b script",
            "frame a344",
            "redirect chain",
            "kb document",
            "frame",
            "b xhr",
            "kb image",
            "fetch collect",
            "request chain",
            "redirected",
            "http redirect",
            "name servers",
            "redacted for",
            "servers",
            "unknown aaaa",
            "search",
            "for privacy",
            "domeny serwery",
            "verdana tahoma",
            "arial",
            "gmt contenttype",
            "meta",
            "small",
            "results jan",
            "present jan",
            "status",
            "record value",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "process details",
            "flag",
            "japan japan",
            "pattern match",
            "ascii text",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "span",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "command",
            "found",
            "defense evasion",
            "monitored target",
            "pulse submit",
            "wikipedia",
            "imap",
            "smtp",
            "ocn open",
            "discussion",
            "stub",
            "jprs database",
            "ocnnttocn",
            "maintenance",
            "outages notice",
            "lock status",
            "state",
            "connected",
            "organization",
            "type",
            "name",
            "server",
            "name server",
            "connected date",
            "algorithm",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cjp ocybertrust",
            "ev ca",
            "g3 validity",
            "ku ontt",
            "docomo",
            "record type",
            "ttl value",
            "thumbprint",
            "emails",
            "date",
            "trojan",
            "pegasus",
            "title error",
            "hostname",
            "pulse pulses",
            "entries",
            "mtb apr",
            "lowfi",
            "win32",
            "a domains",
            "body",
            "worm",
            "virtool",
            "cybota",
            "showing",
            "palantir",
            "prometheus"
          ],
          "references": [
            "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp",
            "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp",
            "ocn.ad.jp - Registrant Org: NTT Communications Corporation",
            "Page Title:  \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN",
            "Nippon Telegraph and Telephone Corporation one governmental now privated",
            "computersandsoftware \u2022 portal sites \u2022 search engines and portals",
            "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com",
            "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2",
            "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80",
            "https://discussions.apple.com/thread/255214328?sortBy=rank",
            "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators",
            "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact",
            "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com",
            "swarm-foundry.com",
            "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org  Domain kinkfuck.com \u2022 nobodycares.art",
            "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com",
            "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5",
            "server-3-164-143-102.nrt20.r.cloudfront.net",
            "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com",
            "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com",
            "https://ww41.porn25.com/",
            "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA",
            "If something curious is found on privatelybowen property we have a constitutional  right to examine it.",
            "Other constitutional rights and privileges written in law where severe courses of action is allowed",
            "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..",
            "Device targeted with l RMS Modules by male in Denver, Co",
            "Attempts to clip target at high rate of speed.Seen again at her residence in October",
            "Target was monitored in store and followed home needed to stop multiple times , change routes.",
            "Multiple attackers. Don\u2019t believe me, look at the pulses.  Caged in by male with deauther watch.",
            "Most of the people doing this are  50\u2019s plus, plus. There are youngsters but many grey haired , grandparents",
            "The older the smarter the way better. These people are brilliant , ruthless and dangerous",
            "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.",
            "Malicious activity seen since a Pulse regarding school outage.",
            "Location search was used to find device users address. It\u2019s with me.",
            "Delete service is being used on this Threat service",
            "Many indicators point to an IP this block is on.",
            "It\u2019s so out of hand,m for 16 people.",
            "https://prometheus-pushgateway-internal.preview.tp-staging.com/",
            "prometheus.netmaker.vonnue.dev",
            "prometheus.dev.aws.finoa.io",
            "Prometheus - Alien God? Morality through the eyes of the immoral",
            "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2879,
            "domain": 1372,
            "URL": 5788,
            "FileHash-SHA256": 1720,
            "CVE": 1,
            "FileHash-MD5": 238,
            "FileHash-SHA1": 241,
            "email": 13
          },
          "indicator_count": 12252,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "119 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "Location search was used to find device users address. It\u2019s with me.",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "The older the smarter the way better. These people are brilliant , ruthless and dangerous",
        "Attempts to clip target at high rate of speed.Seen again at her residence in October",
        "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact",
        "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "https://rdweb.datafoundry.com/",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5",
        "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com",
        "Nippon Telegraph and Telephone Corporation one governmental now privated",
        "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp",
        "Denver Police Department Major Crimes closed investigation",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "If something curious is found on privatelybowen property we have a constitutional  right to examine it.",
        "http://212.33.237.86/images/1/report.php",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "prometheus.dev.aws.finoa.io",
        "https://prometheus-pushgateway-internal.preview.tp-staging.com/",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "Other constitutional rights and privileges written in law where severe courses of action is allowed",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "Device targeted with l RMS Modules by male in Denver, Co",
        "swarm-foundry.com",
        "Melvin Sabey",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "https://ww41.porn25.com/",
        "computersandsoftware \u2022 portal sites \u2022 search engines and portals",
        "Delete service is being used on this Threat service",
        "Prometheus - Alien God? Morality through the eyes of the immoral",
        "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators",
        "Updated | What\u2019s left after theft",
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2",
        "http://watchhers.net/index.php",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "Many indicators point to an IP this block is on.",
        "Multiple attackers. Don\u2019t believe me, look at the pulses.  Caged in by male with deauther watch.",
        "Some may may find this content is very disturbing and offensive",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org  Domain kinkfuck.com \u2022 nobodycares.art",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80",
        "Malicious activity seen since a Pulse regarding school outage.",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "I bring up the personal nature of the crime because a delete service has been used",
        "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.",
        "It\u2019s so out of hand,m for 16 people.",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "https://webmail.police.govmm.org/owa/",
        "Ronda Cordova",
        "prometheus.netmaker.vonnue.dev",
        "https://www.datafoundry.com/category/news/press-releases/",
        "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com",
        "ocn.ad.jp - Registrant Org: NTT Communications Corporation",
        "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp",
        "Target was monitored in store and followed home needed to stop multiple times , change routes.",
        "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God.",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA",
        "Page Title:  \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "Most of the people doing this are  50\u2019s plus, plus. There are youngsters but many grey haired , grandparents",
        "server-3-164-143-102.nrt20.r.cloudfront.net",
        "Quasi Government Case",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "Mark Brian Sabey",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "https://discussions.apple.com/thread/255214328?sortBy=rank",
        "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "Unknown Persons impersonating Private Investigators (plural)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Porn revenge",
            "Tons of malware"
          ],
          "industries": [],
          "unique_indicators": 27349
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/p6f52khhc7a.com",
    "whois": "http://whois.domaintools.com/p6f52khhc7a.com",
    "domain": "p6f52khhc7a.com",
    "hostname": "www.p6f52khhc7a.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69bf261cc4e399447d78776c",
      "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
      "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
      "modified": "2026-04-20T21:01:07.869000",
      "created": "2026-03-21T23:13:32.760000",
      "tags": [
        "sc data",
        "data upload",
        "please sub",
        "include data",
        "extraction",
        "failed",
        "sc pulse",
        "idron anv",
        "extr please",
        "include review",
        "exclude sugges",
        "stop show",
        "typ domain",
        "united",
        "virtool",
        "name servers",
        "cryp",
        "emails",
        "win32",
        "ip address",
        "worm",
        "trojan",
        "learn",
        "suspicious",
        "informative",
        "ck id",
        "name tactics",
        "command",
        "adversaries",
        "spawns",
        "ssl certificate",
        "initial access",
        "link initial",
        "prefetch8",
        "mitre att",
        "ck matrix",
        "flag",
        "windows nt",
        "win64",
        "accept",
        "encrypt",
        "form",
        "hybrid",
        "bypass",
        "general",
        "path",
        "iframe",
        "click",
        "strings",
        "anchor https",
        "anchor",
        "liberal",
        "sabey",
        "liberal friends",
        "meta",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "info initial",
        "access ta0001",
        "compromise",
        "t1189 network",
        "communication",
        "get http",
        "artifacts v",
        "full reports",
        "v get",
        "help dns",
        "resolutions",
        "ip traffic",
        "extr data",
        "enter sc",
        "extra data",
        "referen",
        "broth",
        "passive dns",
        "urls",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "none google",
        "safe browsing",
        "inquest labs",
        "lucas acha",
        "code integrity",
        "checks creation",
        "otx logo",
        "all hostname",
        "files",
        "domain",
        "protect",
        "date",
        "title",
        "exchange",
        "se http",
        "present jan",
        "present feb",
        "present dec",
        "backdoor",
        "certificate",
        "all domain",
        "alibaba cloud",
        "hichina",
        "porkbun llc",
        "cloudflare",
        "namecheap inc",
        "namecheap",
        "domains",
        "dynadot llc",
        "ascio",
        "denmark",
        "url https",
        "filehashsha256",
        "url http",
        "dopple ai",
        "snit",
        "iocs",
        "otx description",
        "information",
        "report spam",
        "delete service",
        "poem",
        "hunter",
        "malicious",
        "porn revenge",
        "brian sabeys",
        "all report",
        "spam delete",
        "rl http",
        "https",
        "expiration http",
        "spam brian",
        "swipper",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashmd5",
        "filehashsha1",
        "sha256",
        "scan",
        "learn more",
        "indicators show",
        "tbmvid",
        "sourcelnms",
        "zx1724209326040",
        "xxx videos",
        "xxxvideohd",
        "adversary",
        "packing",
        "palantir.com",
        "discovery",
        "victim won case",
        "doin it",
        "palantirian abuse",
        "apple",
        "sabey data centers",
        "insurance",
        "quasi government",
        "the brother sabey",
        "reimer",
        "law enforcement",
        "vessel state",
        "sabey porn",
        "hall evans",
        "christopher ahmann",
        "defamation",
        "google"
      ],
      "references": [
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "http://watchhers.net/index.php",
        "http://212.33.237.86/images/1/report.php",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://webmail.police.govmm.org/owa/",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Mark Brian Sabey",
        "Melvin Sabey",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "Ronda Cordova",
        "Unknown Persons impersonating Private Investigators (plural)",
        "Quasi Government Case",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "Denver Police Department Major Crimes closed investigation",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "I bring up the personal nature of the crime because a delete service has been used",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "Updated | What\u2019s left after theft",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "https://www.datafoundry.com/category/news/press-releases/",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "Some may may find this content is very disturbing and offensive"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Porn Revenge",
          "display_name": "Porn Revenge",
          "target": null
        },
        {
          "id": "Tons of Malware",
          "display_name": "Tons of Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1132.001",
          "name": "Standard Encoding",
          "display_name": "T1132.001 - Standard Encoding"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1495",
          "name": "Firmware Corruption",
          "display_name": "T1495 - Firmware Corruption"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6034,
        "domain": 1422,
        "FileHash-MD5": 274,
        "FileHash-SHA1": 252,
        "FileHash-SHA256": 3378,
        "email": 11,
        "hostname": 2753,
        "CVE": 1,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 14134,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "41 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6958372ef9da31513d96bebb",
      "name": "Connected-IOS remotely connected to 180.4.1.2 \u2022  ocn.ad.jp -NTT Communications Corporation",
      "description": "Retaliation? IOS remotely connected to 180.4.1.2 \u2022  ocn.ad.jp -NTT Communications Corporation for malicious control | found in the analytics of a highly target device: I\u2019ve included related pulses from 2 other threat responders and an Apple discussion post. Surprisingly, most of the IoC\u2019s pulsed came from one page of analytics. | \u2022 \"avconferenced\", \"procPath\" : \"\\/usr\\/libexec\\/avconferenced |  180.4.1.2 | a version of\npegasus found. | https://prometheus-pushgateway-internal.preview.tp-staging.com/\t\nhostname: prometheus.netmaker.vonnue.dev\t\nhostname: prometheus.dev.aws.finoa.io |\nSince Prometheus pulse . I realize now every Prometheus pulse illicits outrageous behavior.. Is this a secret society? Try to be more secretive. Owl heads in lawn. This behavior illicits investigation for a fix. Please STOP. I\u2019m done looking at Prometheus. Please stop leaving artifacts.",
      "modified": "2026-02-01T20:00:08.812000",
      "created": "2026-01-02T21:22:54.247000",
      "tags": [
        "syscall",
        "nsrunloop",
        "objcclass",
        "region type",
        "start",
        "vsize",
        "prtmax shrmod",
        "region detailn",
        "unused space",
        "at startn",
        "guard",
        "urls",
        "url analysis",
        "verdict",
        "domain",
        "address",
        "location japan",
        "hikone",
        "japan asn",
        "as4713 ntt",
        "related tags",
        "none external",
        "aaaa",
        "united",
        "passive dns",
        "ip address",
        "japan",
        "present dec",
        "domain add",
        "files",
        "japan unknown",
        "present jul",
        "present oct",
        "present sep",
        "present aug",
        "present jun",
        "japan showing",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "reverse dns",
        "present nov",
        "present",
        "present may",
        "present mar",
        "present apr",
        "data upload",
        "extraction",
        "failed",
        "files ip",
        "moved",
        "gmt content",
        "ipv4 add",
        "location united",
        "title",
        "ipv4",
        "dns resolutions",
        "hostname add",
        "asn as4713",
        "all ipv4",
        "google",
        "ocn ntt",
        "googlecl",
        "http",
        "amazon02",
        "akamaias",
        "page url",
        "yahoojp",
        "december",
        "jp summary",
        "february",
        "asn15169",
        "tokyo",
        "kansas city",
        "asn396982",
        "asn30286",
        "asn16509",
        "cisco",
        "umbrella rank",
        "cisco umbrella",
        "rank",
        "kitashinagawa",
        "sureserver ev",
        "ca g3",
        "domains",
        "hashes",
        "microsoft",
        "docomo business",
        "ml14325",
        "as autonomous",
        "asn8075",
        "ip information",
        "ipasns ip",
        "detail domain",
        "domain tree",
        "links domain",
        "requested",
        "value",
        "automatic",
        "webgl",
        "please",
        "mr value",
        "muid value",
        "mjl function",
        "dcmlinker",
        "paq string",
        "kb script",
        "b image",
        "b script",
        "frame a344",
        "redirect chain",
        "kb document",
        "frame",
        "b xhr",
        "kb image",
        "fetch collect",
        "request chain",
        "redirected",
        "http redirect",
        "name servers",
        "redacted for",
        "servers",
        "unknown aaaa",
        "search",
        "for privacy",
        "domeny serwery",
        "verdana tahoma",
        "arial",
        "gmt contenttype",
        "meta",
        "small",
        "results jan",
        "present jan",
        "status",
        "record value",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "process details",
        "flag",
        "japan japan",
        "pattern match",
        "ascii text",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "span",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "command",
        "found",
        "defense evasion",
        "monitored target",
        "pulse submit",
        "wikipedia",
        "imap",
        "smtp",
        "ocn open",
        "discussion",
        "stub",
        "jprs database",
        "ocnnttocn",
        "maintenance",
        "outages notice",
        "lock status",
        "state",
        "connected",
        "organization",
        "type",
        "name",
        "server",
        "name server",
        "connected date",
        "algorithm",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cjp ocybertrust",
        "ev ca",
        "g3 validity",
        "ku ontt",
        "docomo",
        "record type",
        "ttl value",
        "thumbprint",
        "emails",
        "date",
        "trojan",
        "pegasus",
        "title error",
        "hostname",
        "pulse pulses",
        "entries",
        "mtb apr",
        "lowfi",
        "win32",
        "a domains",
        "body",
        "worm",
        "virtool",
        "cybota",
        "showing",
        "palantir",
        "prometheus"
      ],
      "references": [
        "ocn.ne.jp \u2022 180.4.1.2 \u2022 gateway1.ocn.ad.jp",
        "login.ocn.ne.jp 122.28.88.229 \u2022 outpost@alpha.ocn.ne.jp",
        "ocn.ad.jp - Registrant Org: NTT Communications Corporation",
        "Page Title:  \u30ed\u30b0\u30a4\u30f3 | OCN\u30e1\u30fc\u30eb | OCN",
        "Nippon Telegraph and Telephone Corporation one governmental now privated",
        "computersandsoftware \u2022 portal sites \u2022 search engines and portals",
        "(Found on targeted iOS device) mr-file-connector-193.api.auxosandbox.com",
        "Guardicore by CyberHunterAutoFeed \u2022 https://otx.alienvault.com/pulse/655d47fb128a006a7d06afa2",
        "Japanese Phishing Site by pingineer \u2022 https://otx.alienvault.com/pulse/61d3b380c44ee030dd092a80",
        "https://discussions.apple.com/thread/255214328?sortBy=rank",
        "https://urlscan.io/result/98a3575f-9b94-4ef3-ae84-8e585f882151/#indicators",
        "Interesting (found in pulse) https://www.studentfinancewales.co.uk/contact",
        "kalpak.palantirfedstart.com \u2022 lsauth-vault.palantirfedstart.com \u2022 sandboxes-ranunculus.palantirfedstart.com",
        "swarm-foundry.com",
        "When you see silly related domains it\u2019s probably Palantir kids: fuckingshitshow.org  Domain kinkfuck.com \u2022 nobodycares.art",
        "heavy-r.com \u2022 fartyphant.com \u2022 uglyphant.com \u2022 maciej.sztajerwald@gmail.com",
        "https://hybrid-analysis.com/sample/6af451b8e64c3f8abafc84e776fe6c257888e0875b2d22c75b23b13960f46567/69580966ed3458719b0f0ed5",
        "server-3-164-143-102.nrt20.r.cloudfront.net",
        "ec2-3-115-135-167.ap-northeast-1.compute.amazonaws.com",
        "ec2-57-181-50-85.ap-northeast-1.compute.amazonaws.com",
        "https://ww41.porn25.com/",
        "https://otx.alienvault.com/indicator/url/https://t.notif-laposte.info/TrackActions/NGJlYjE5NjZhZDlkODU0NzE3Yzg3Zjk3ODJkMmMxZWRjMTlkODAxZmEyMjY5YjU5YjY1MGU1OWFmZTdhMDlhMmM2YjY3ZTBiYzYwNWUwODdmMzkzZDc5ZjAwNDViODM1OGU5MTA0M2IzMjRmOGQwNTgxZGZjMmUyODFlZDI3MDYzZTQzNzg4NGVkMWJmMDgwMzM0NTA5OGRmY2M0NTVjZA",
        "If something curious is found on privatelybowen property we have a constitutional  right to examine it.",
        "Other constitutional rights and privileges written in law where severe courses of action is allowed",
        "iOS device, Update 26.2 , heavily monitored target of death threats, attempts & unfortunate outcome..",
        "Device targeted with l RMS Modules by male in Denver, Co",
        "Attempts to clip target at high rate of speed.Seen again at her residence in October",
        "Target was monitored in store and followed home needed to stop multiple times , change routes.",
        "Multiple attackers. Don\u2019t believe me, look at the pulses.  Caged in by male with deauther watch.",
        "Most of the people doing this are  50\u2019s plus, plus. There are youngsters but many grey haired , grandparents",
        "The older the smarter the way better. These people are brilliant , ruthless and dangerous",
        "Phone recently accessed, a tiny unauthorized speaker was on. Threat actors connected.",
        "Malicious activity seen since a Pulse regarding school outage.",
        "Location search was used to find device users address. It\u2019s with me.",
        "Delete service is being used on this Threat service",
        "Many indicators point to an IP this block is on.",
        "It\u2019s so out of hand,m for 16 people.",
        "https://prometheus-pushgateway-internal.preview.tp-staging.com/",
        "prometheus.netmaker.vonnue.dev",
        "prometheus.dev.aws.finoa.io",
        "Prometheus - Alien God? Morality through the eyes of the immoral",
        "Prometheus- allegedly related to Peter Thiel , Elon Musk and tech bro Joes who are playing God."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2879,
        "domain": 1372,
        "URL": 5788,
        "FileHash-SHA256": 1720,
        "CVE": 1,
        "FileHash-MD5": 238,
        "FileHash-SHA1": 241,
        "email": 13
      },
      "indicator_count": 12252,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "119 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.p6f52khhc7a.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.p6f52khhc7a.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780262911.4384887
}