{
  "type": "URL",
  "indicator": "https://www.xiancloudxian.top/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.xiancloudxian.top/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4226241414,
      "indicator": "https://www.xiancloudxian.top/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69bf261cc4e399447d78776c",
          "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
          "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
          "modified": "2026-04-20T21:01:07.869000",
          "created": "2026-03-21T23:13:32.760000",
          "tags": [
            "sc data",
            "data upload",
            "please sub",
            "include data",
            "extraction",
            "failed",
            "sc pulse",
            "idron anv",
            "extr please",
            "include review",
            "exclude sugges",
            "stop show",
            "typ domain",
            "united",
            "virtool",
            "name servers",
            "cryp",
            "emails",
            "win32",
            "ip address",
            "worm",
            "trojan",
            "learn",
            "suspicious",
            "informative",
            "ck id",
            "name tactics",
            "command",
            "adversaries",
            "spawns",
            "ssl certificate",
            "initial access",
            "link initial",
            "prefetch8",
            "mitre att",
            "ck matrix",
            "flag",
            "windows nt",
            "win64",
            "accept",
            "encrypt",
            "form",
            "hybrid",
            "bypass",
            "general",
            "path",
            "iframe",
            "click",
            "strings",
            "anchor https",
            "anchor",
            "liberal",
            "sabey",
            "liberal friends",
            "meta",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "info initial",
            "access ta0001",
            "compromise",
            "t1189 network",
            "communication",
            "get http",
            "artifacts v",
            "full reports",
            "v get",
            "help dns",
            "resolutions",
            "ip traffic",
            "extr data",
            "enter sc",
            "extra data",
            "referen",
            "broth",
            "passive dns",
            "urls",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "none google",
            "safe browsing",
            "inquest labs",
            "lucas acha",
            "code integrity",
            "checks creation",
            "otx logo",
            "all hostname",
            "files",
            "domain",
            "protect",
            "date",
            "title",
            "exchange",
            "se http",
            "present jan",
            "present feb",
            "present dec",
            "backdoor",
            "certificate",
            "all domain",
            "alibaba cloud",
            "hichina",
            "porkbun llc",
            "cloudflare",
            "namecheap inc",
            "namecheap",
            "domains",
            "dynadot llc",
            "ascio",
            "denmark",
            "url https",
            "filehashsha256",
            "url http",
            "dopple ai",
            "snit",
            "iocs",
            "otx description",
            "information",
            "report spam",
            "delete service",
            "poem",
            "hunter",
            "malicious",
            "porn revenge",
            "brian sabeys",
            "all report",
            "spam delete",
            "rl http",
            "https",
            "expiration http",
            "spam brian",
            "swipper",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashmd5",
            "filehashsha1",
            "sha256",
            "scan",
            "learn more",
            "indicators show",
            "tbmvid",
            "sourcelnms",
            "zx1724209326040",
            "xxx videos",
            "xxxvideohd",
            "adversary",
            "packing",
            "palantir.com",
            "discovery",
            "victim won case",
            "doin it",
            "palantirian abuse",
            "apple",
            "sabey data centers",
            "insurance",
            "quasi government",
            "the brother sabey",
            "reimer",
            "law enforcement",
            "vessel state",
            "sabey porn",
            "hall evans",
            "christopher ahmann",
            "defamation",
            "google"
          ],
          "references": [
            "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
            "http://watchhers.net/index.php",
            "http://212.33.237.86/images/1/report.php",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://webmail.police.govmm.org/owa/",
            "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
            "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
            "Mark Brian Sabey",
            "Melvin Sabey",
            "Christopher P \u2018Buzz\u2019 Ahmann",
            "Ronda Cordova",
            "Unknown Persons impersonating Private Investigators (plural)",
            "Quasi Government Case",
            "Victim silenced. Struck by Car Driven by male police let walk",
            "Denver Police let this attempted murder walk. Cited him as a ghost driver",
            "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
            "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
            "Reimer was a PT. Unknown whereabouts , name or job description",
            "Denver Police Department Major Crimes closed investigation",
            "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
            "I bring up the personal nature of the crime because a delete service has been used",
            "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
            "All IoC\u2019s originate from sources named. There are some unknown attackers",
            "This is a serious crime. I\u2019m certain God WILL pay them.",
            "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
            "http://palantirwww.sweetheartvideo.com/ (weirdness)",
            "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2-lbl.dvr.dn2.n-helix.com/",
            "https://207-207-25-201.fwd.datafoundry.com/",
            "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
            "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2sdbl.dvr.dn2.n-helix.com/",
            "Updated | What\u2019s left after theft",
            "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
            "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
            "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
            "https://www.datafoundry.com/category/news/press-releases/",
            "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
            "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
            "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
            "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
            "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
            "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
            "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
            "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
            "Some may may find this content is very disturbing and offensive"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Porn Revenge",
              "display_name": "Porn Revenge",
              "target": null
            },
            {
              "id": "Tons of Malware",
              "display_name": "Tons of Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1132.001",
              "name": "Standard Encoding",
              "display_name": "T1132.001 - Standard Encoding"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1495",
              "name": "Firmware Corruption",
              "display_name": "T1495 - Firmware Corruption"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6034,
            "domain": 1422,
            "FileHash-MD5": 274,
            "FileHash-SHA1": 252,
            "FileHash-SHA256": 3378,
            "email": 11,
            "hostname": 2753,
            "CVE": 1,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 14134,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "42 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a2127d12dce12538b57d72",
          "name": "FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets  ~ Apple Jacked Targets",
          "description": "Remote Attack - FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets.\n\nChecked search history on a targeted device and found an FBI link apparently delivered via unknown AI technology.\n|| yara detections\nzur foerderung\nA\n+ Add Tag\n\u8840\nCount: 1\nGRO Probability: 1\nText: Suricata Alerts Event\nCategory Description CID\nIND131.188.40.12g otx.alienvault.com\nlocal:49181 (TCP) Misc\nAttack ET TOR Known Tor\nRelay/Router (Not Exit)\n\"A\" | [[Next pulse will list on malware, rats , bats, Trojans used]",
          "modified": "2026-03-29T20:03:36.333000",
          "created": "2026-02-27T21:54:05.261000",
          "tags": [
            "pattern match",
            "heuristic match",
            "all url",
            "files domain",
            "pulses otx",
            "germany unknown",
            "aaaa",
            "ip address",
            "emails",
            "gmt server",
            "vary",
            "modified",
            "accept",
            "title",
            "present feb",
            "present jan",
            "united",
            "part",
            "moved",
            "passive dns",
            "cname",
            "final",
            "bill",
            "antivm",
            "xlsx",
            "xlsm",
            "urls",
            "otx logo",
            "all hostname",
            "server",
            "organization",
            "city",
            "stateprovince",
            "postal code",
            "phone",
            "registrar abuse",
            "privacy admin",
            "paris admin",
            "april",
            "direct",
            "february",
            "http",
            "dfn verein",
            "zur foerderung",
            "domain",
            "page url",
            "tags",
            "de summary",
            "erlangen",
            "germany",
            "securitytrails",
            "de seen",
            "general info",
            "geo erlangen",
            "as as680",
            "de note",
            "route",
            "data upload",
            "extraction",
            "failed",
            "extra data",
            "referen",
            "include review",
            "exclude data",
            "summary",
            "url age",
            "as680",
            "se source",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "over",
            "ascii text",
            "mitre att",
            "size",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "node traffic",
            "tlsv1",
            "search",
            "rgba",
            "medium",
            "read c",
            "module load",
            "t1129",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "calls",
            "apis",
            "reads",
            "model",
            "value",
            "getprocaddress",
            "show technique",
            "ck matrix",
            "access type",
            "windir",
            "regexp",
            "open",
            "date",
            "format",
            "virtual disk drive",
            "sha256",
            "sha1",
            "body",
            "filehashsha1",
            "found",
            "unknown",
            "stop",
            "root",
            "form",
            "9999",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "bad traffic",
            "et info",
            "tls handshake",
            "failure",
            "flag",
            "analysis tip",
            "openurl c",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "show",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious yara",
            "detections none",
            "less ip",
            "dynamicloader",
            "get na",
            "c3bhaw",
            "high",
            "copy",
            "guard",
            "push",
            "Palantir",
            "Foundry",
            "Whitehouse",
            "X.Com",
            "Justice.gov",
            "Apple",
            "AI",
            "node traffic"
          ],
          "references": [
            "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
            "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
            "http://truefoundry.prodigaltech.com/",
            "git.spywarewatchdog.org",
            "marriott-control-prd.accenture.cn",
            "marriott-datacenter-prd.accenture.cn",
            "accenture.cn",
            "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
            "target.id  \u2022 tostring.call  \u2022 title.search",
            "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
            "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
            "http://truefoundry.prodigaltech.com/",
            "Attacker being used by several legal entities attacking a target\u2019s family",
            "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
            "Luxury Apartments and Townhome communities do use Foundry Palantir",
            "Some Colorado communities have been taken over by the State Government",
            "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
            "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
            "Foundry Foot Soldiers are still in Colorado targeting innocents",
            "Foundry Palantir still has a presence in Colorado",
            "I need some help.",
            "Accurately tipped about air travel safety. In past. Proven true.",
            "Tipped of new looming airline threats",
            "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
            "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
            "FBI files opened up on a targeted phone, Iunseel, only in search history.",
            "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
            "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
            "Hours after files were deemed malicious. We powered on targeted Smart TV",
            "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
            "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
            "A man claiming to have the name Sebastian is communicating with targets love one",
            "Uses code, no phone calls. Connected via instagram.",
            "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
            "By remote view of NEW targeys view, all key calls are routed through him.",
            "Targets associated warned. Not very open to advice.",
            "I would post his public information. It may be unwise.",
            "Connects to all NEW targets key contacts main targets contacts.",
            "We have foot soldiers. Be aware",
            "https://www.justice.gov/opa/pr/departmen.t",
            "https://api.manus.im/api/oauth2_callback/apple",
            "https://apple.btprmjo.cc/",
            "https://creative.miqdigital.com/.well-known/apple-app-site-association",
            "internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
            "http://www.internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
            "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
            "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Node Traffic",
              "display_name": "Node Traffic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1055.011",
              "name": "Extra Window Memory Injection",
              "display_name": "T1055.011 - Extra Window Memory Injection"
            },
            {
              "id": "T1055.001",
              "name": "Dynamic-link Library Injection",
              "display_name": "T1055.001 - Dynamic-link Library Injection"
            },
            {
              "id": "T1055.004",
              "name": "Asynchronous Procedure Call",
              "display_name": "T1055.004 - Asynchronous Procedure Call"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1055.014",
              "name": "VDSO Hijacking",
              "display_name": "T1055.014 - VDSO Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5643,
            "domain": 700,
            "hostname": 1918,
            "FileHash-SHA256": 1161,
            "FileHash-MD5": 235,
            "email": 4,
            "FileHash-SHA1": 200,
            "CVE": 1,
            "CIDR": 2,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 9873,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "64 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69aa019f4509897e354fe029",
          "name": "credit Q Vashti Cloned Pulse ",
          "description": "",
          "modified": "2026-03-29T20:03:36.333000",
          "created": "2026-03-05T22:20:15.324000",
          "tags": [
            "pattern match",
            "heuristic match",
            "all url",
            "files domain",
            "pulses otx",
            "germany unknown",
            "aaaa",
            "ip address",
            "emails",
            "gmt server",
            "vary",
            "modified",
            "accept",
            "title",
            "present feb",
            "present jan",
            "united",
            "part",
            "moved",
            "passive dns",
            "cname",
            "final",
            "bill",
            "antivm",
            "xlsx",
            "xlsm",
            "urls",
            "otx logo",
            "all hostname",
            "server",
            "organization",
            "city",
            "stateprovince",
            "postal code",
            "phone",
            "registrar abuse",
            "privacy admin",
            "paris admin",
            "april",
            "direct",
            "february",
            "http",
            "dfn verein",
            "zur foerderung",
            "domain",
            "page url",
            "tags",
            "de summary",
            "erlangen",
            "germany",
            "securitytrails",
            "de seen",
            "general info",
            "geo erlangen",
            "as as680",
            "de note",
            "route",
            "data upload",
            "extraction",
            "failed",
            "extra data",
            "referen",
            "include review",
            "exclude data",
            "summary",
            "url age",
            "as680",
            "se source",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "over",
            "ascii text",
            "mitre att",
            "size",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "node traffic",
            "tlsv1",
            "search",
            "rgba",
            "medium",
            "read c",
            "module load",
            "t1129",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "calls",
            "apis",
            "reads",
            "model",
            "value",
            "getprocaddress",
            "show technique",
            "ck matrix",
            "access type",
            "windir",
            "regexp",
            "open",
            "date",
            "format",
            "virtual disk drive",
            "sha256",
            "sha1",
            "body",
            "filehashsha1",
            "found",
            "unknown",
            "stop",
            "root",
            "form",
            "9999",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "bad traffic",
            "et info",
            "tls handshake",
            "failure",
            "flag",
            "analysis tip",
            "openurl c",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "show",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious yara",
            "detections none",
            "less ip",
            "dynamicloader",
            "get na",
            "c3bhaw",
            "high",
            "copy",
            "guard",
            "push",
            "Palantir",
            "Foundry",
            "Whitehouse",
            "X.Com",
            "Justice.gov",
            "Apple",
            "AI",
            "node traffic"
          ],
          "references": [
            "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
            "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
            "http://truefoundry.prodigaltech.com/",
            "git.spywarewatchdog.org",
            "marriott-control-prd.accenture.cn",
            "marriott-datacenter-prd.accenture.cn",
            "accenture.cn",
            "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
            "target.id  \u2022 tostring.call  \u2022 title.search",
            "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
            "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
            "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
            "http://truefoundry.prodigaltech.com/",
            "Attacker being used by several legal entities attacking a target\u2019s family",
            "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
            "Luxury Apartments and Townhome communities do use Foundry Palantir",
            "Some Colorado communities have been taken over by the State Government",
            "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
            "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
            "Foundry Foot Soldiers are still in Colorado targeting innocents",
            "Foundry Palantir still has a presence in Colorado",
            "I need some help.",
            "Accurately tipped about air travel safety. In past. Proven true.",
            "Tipped of new looming airline threats",
            "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
            "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
            "FBI files opened up on a targeted phone, Iunseel, only in search history.",
            "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
            "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
            "Hours after files were deemed malicious. We powered on targeted Smart TV",
            "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
            "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
            "A man claiming to have the name Sebastian is communicating with targets love one",
            "Uses code, no phone calls. Connected via instagram.",
            "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
            "By remote view of NEW targeys view, all key calls are routed through him.",
            "Targets associated warned. Not very open to advice.",
            "I would post his public information. It may be unwise.",
            "Connects to all NEW targets key contacts main targets contacts.",
            "We have foot soldiers. Be aware",
            "https://www.justice.gov/opa/pr/departmen.t",
            "https://api.manus.im/api/oauth2_callback/apple",
            "https://apple.btprmjo.cc/",
            "https://creative.miqdigital.com/.well-known/apple-app-site-association",
            "internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
            "http://www.internationalfrontier.com",
            "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
            "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
            "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Node Traffic",
              "display_name": "Node Traffic",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1055.011",
              "name": "Extra Window Memory Injection",
              "display_name": "T1055.011 - Extra Window Memory Injection"
            },
            {
              "id": "T1055.001",
              "name": "Dynamic-link Library Injection",
              "display_name": "T1055.001 - Dynamic-link Library Injection"
            },
            {
              "id": "T1055.004",
              "name": "Asynchronous Procedure Call",
              "display_name": "T1055.004 - Asynchronous Procedure Call"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1055.014",
              "name": "VDSO Hijacking",
              "display_name": "T1055.014 - VDSO Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69a2127d12dce12538b57d72",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5644,
            "domain": 701,
            "hostname": 1920,
            "FileHash-SHA256": 1161,
            "FileHash-MD5": 235,
            "email": 4,
            "FileHash-SHA1": 200,
            "CVE": 1,
            "CIDR": 2,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 9877,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "64 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "I bring up the personal nature of the crime because a delete service has been used",
        "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "Updated | What\u2019s left after theft",
        "FBI files opened up on a targeted phone, Iunseel, only in search history.",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
        "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "http://212.33.237.86/images/1/report.php",
        "accenture.cn",
        "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "Accurately tipped about air travel safety. In past. Proven true.",
        "http://watchhers.net/index.php",
        "https://www.datafoundry.com/category/news/press-releases/",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
        "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
        "Foundry Foot Soldiers are still in Colorado targeting innocents",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
        "We have foot soldiers. Be aware",
        "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Melvin Sabey",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "marriott-datacenter-prd.accenture.cn",
        "A man claiming to have the name Sebastian is communicating with targets love one",
        "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "By remote view of NEW targeys view, all key calls are routed through him.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "git.spywarewatchdog.org",
        "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
        "https://creative.miqdigital.com/.well-known/apple-app-site-association",
        "Uses code, no phone calls. Connected via instagram.",
        "Mark Brian Sabey",
        "https://webmail.police.govmm.org/owa/",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "I would post his public information. It may be unwise.",
        "https://api.manus.im/api/oauth2_callback/apple",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "https://www.justice.gov/opa/pr/departmen.t",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "Foundry Palantir still has a presence in Colorado",
        "I need some help.",
        "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "Hours after files were deemed malicious. We powered on targeted Smart TV",
        "Targets associated warned. Not very open to advice.",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "internationalfrontier.com",
        "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
        "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97",
        "target.id  \u2022 tostring.call  \u2022 title.search",
        "Denver Police Department Major Crimes closed investigation",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "Attacker being used by several legal entities attacking a target\u2019s family",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "Some Colorado communities have been taken over by the State Government",
        "Luxury Apartments and Townhome communities do use Foundry Palantir",
        "Unknown Persons impersonating Private Investigators (plural)",
        "https://apple.btprmjo.cc/",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "Connects to all NEW targets key contacts main targets contacts.",
        "marriott-control-prd.accenture.cn",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "Quasi Government Case",
        "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
        "http://www.internationalfrontier.com",
        "http://truefoundry.prodigaltech.com/",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "Some may may find this content is very disturbing and offensive",
        "Ronda Cordova",
        "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "https://rdweb.datafoundry.com/",
        "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
        "Tipped of new looming airline threats"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Node traffic",
            "Tons of malware",
            "Porn revenge"
          ],
          "industries": [],
          "unique_indicators": 24645
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/xiancloudxian.top",
    "whois": "http://whois.domaintools.com/xiancloudxian.top",
    "domain": "xiancloudxian.top",
    "hostname": "www.xiancloudxian.top"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69bf261cc4e399447d78776c",
      "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
      "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
      "modified": "2026-04-20T21:01:07.869000",
      "created": "2026-03-21T23:13:32.760000",
      "tags": [
        "sc data",
        "data upload",
        "please sub",
        "include data",
        "extraction",
        "failed",
        "sc pulse",
        "idron anv",
        "extr please",
        "include review",
        "exclude sugges",
        "stop show",
        "typ domain",
        "united",
        "virtool",
        "name servers",
        "cryp",
        "emails",
        "win32",
        "ip address",
        "worm",
        "trojan",
        "learn",
        "suspicious",
        "informative",
        "ck id",
        "name tactics",
        "command",
        "adversaries",
        "spawns",
        "ssl certificate",
        "initial access",
        "link initial",
        "prefetch8",
        "mitre att",
        "ck matrix",
        "flag",
        "windows nt",
        "win64",
        "accept",
        "encrypt",
        "form",
        "hybrid",
        "bypass",
        "general",
        "path",
        "iframe",
        "click",
        "strings",
        "anchor https",
        "anchor",
        "liberal",
        "sabey",
        "liberal friends",
        "meta",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "info initial",
        "access ta0001",
        "compromise",
        "t1189 network",
        "communication",
        "get http",
        "artifacts v",
        "full reports",
        "v get",
        "help dns",
        "resolutions",
        "ip traffic",
        "extr data",
        "enter sc",
        "extra data",
        "referen",
        "broth",
        "passive dns",
        "urls",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "none google",
        "safe browsing",
        "inquest labs",
        "lucas acha",
        "code integrity",
        "checks creation",
        "otx logo",
        "all hostname",
        "files",
        "domain",
        "protect",
        "date",
        "title",
        "exchange",
        "se http",
        "present jan",
        "present feb",
        "present dec",
        "backdoor",
        "certificate",
        "all domain",
        "alibaba cloud",
        "hichina",
        "porkbun llc",
        "cloudflare",
        "namecheap inc",
        "namecheap",
        "domains",
        "dynadot llc",
        "ascio",
        "denmark",
        "url https",
        "filehashsha256",
        "url http",
        "dopple ai",
        "snit",
        "iocs",
        "otx description",
        "information",
        "report spam",
        "delete service",
        "poem",
        "hunter",
        "malicious",
        "porn revenge",
        "brian sabeys",
        "all report",
        "spam delete",
        "rl http",
        "https",
        "expiration http",
        "spam brian",
        "swipper",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashmd5",
        "filehashsha1",
        "sha256",
        "scan",
        "learn more",
        "indicators show",
        "tbmvid",
        "sourcelnms",
        "zx1724209326040",
        "xxx videos",
        "xxxvideohd",
        "adversary",
        "packing",
        "palantir.com",
        "discovery",
        "victim won case",
        "doin it",
        "palantirian abuse",
        "apple",
        "sabey data centers",
        "insurance",
        "quasi government",
        "the brother sabey",
        "reimer",
        "law enforcement",
        "vessel state",
        "sabey porn",
        "hall evans",
        "christopher ahmann",
        "defamation",
        "google"
      ],
      "references": [
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "http://watchhers.net/index.php",
        "http://212.33.237.86/images/1/report.php",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://webmail.police.govmm.org/owa/",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Mark Brian Sabey",
        "Melvin Sabey",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "Ronda Cordova",
        "Unknown Persons impersonating Private Investigators (plural)",
        "Quasi Government Case",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "Denver Police Department Major Crimes closed investigation",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "I bring up the personal nature of the crime because a delete service has been used",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "Updated | What\u2019s left after theft",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "https://www.datafoundry.com/category/news/press-releases/",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "Some may may find this content is very disturbing and offensive"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Porn Revenge",
          "display_name": "Porn Revenge",
          "target": null
        },
        {
          "id": "Tons of Malware",
          "display_name": "Tons of Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1132.001",
          "name": "Standard Encoding",
          "display_name": "T1132.001 - Standard Encoding"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1495",
          "name": "Firmware Corruption",
          "display_name": "T1495 - Firmware Corruption"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6034,
        "domain": 1422,
        "FileHash-MD5": 274,
        "FileHash-SHA1": 252,
        "FileHash-SHA256": 3378,
        "email": 11,
        "hostname": 2753,
        "CVE": 1,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 14134,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "42 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a2127d12dce12538b57d72",
      "name": "FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets  ~ Apple Jacked Targets",
      "description": "Remote Attack - FBI Files | Tor device connection | Unique attack against (non -criminal) monitored targets.\n\nChecked search history on a targeted device and found an FBI link apparently delivered via unknown AI technology.\n|| yara detections\nzur foerderung\nA\n+ Add Tag\n\u8840\nCount: 1\nGRO Probability: 1\nText: Suricata Alerts Event\nCategory Description CID\nIND131.188.40.12g otx.alienvault.com\nlocal:49181 (TCP) Misc\nAttack ET TOR Known Tor\nRelay/Router (Not Exit)\n\"A\" | [[Next pulse will list on malware, rats , bats, Trojans used]",
      "modified": "2026-03-29T20:03:36.333000",
      "created": "2026-02-27T21:54:05.261000",
      "tags": [
        "pattern match",
        "heuristic match",
        "all url",
        "files domain",
        "pulses otx",
        "germany unknown",
        "aaaa",
        "ip address",
        "emails",
        "gmt server",
        "vary",
        "modified",
        "accept",
        "title",
        "present feb",
        "present jan",
        "united",
        "part",
        "moved",
        "passive dns",
        "cname",
        "final",
        "bill",
        "antivm",
        "xlsx",
        "xlsm",
        "urls",
        "otx logo",
        "all hostname",
        "server",
        "organization",
        "city",
        "stateprovince",
        "postal code",
        "phone",
        "registrar abuse",
        "privacy admin",
        "paris admin",
        "april",
        "direct",
        "february",
        "http",
        "dfn verein",
        "zur foerderung",
        "domain",
        "page url",
        "tags",
        "de summary",
        "erlangen",
        "germany",
        "securitytrails",
        "de seen",
        "general info",
        "geo erlangen",
        "as as680",
        "de note",
        "route",
        "data upload",
        "extraction",
        "failed",
        "extra data",
        "referen",
        "include review",
        "exclude data",
        "summary",
        "url age",
        "as680",
        "se source",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "over",
        "ascii text",
        "mitre att",
        "size",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "node traffic",
        "tlsv1",
        "search",
        "rgba",
        "medium",
        "read c",
        "module load",
        "t1129",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "calls",
        "apis",
        "reads",
        "model",
        "value",
        "getprocaddress",
        "show technique",
        "ck matrix",
        "access type",
        "windir",
        "regexp",
        "open",
        "date",
        "format",
        "virtual disk drive",
        "sha256",
        "sha1",
        "body",
        "filehashsha1",
        "found",
        "unknown",
        "stop",
        "root",
        "form",
        "9999",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "bad traffic",
        "et info",
        "tls handshake",
        "failure",
        "flag",
        "analysis tip",
        "openurl c",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "show",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious yara",
        "detections none",
        "less ip",
        "dynamicloader",
        "get na",
        "c3bhaw",
        "high",
        "copy",
        "guard",
        "push",
        "Palantir",
        "Foundry",
        "Whitehouse",
        "X.Com",
        "Justice.gov",
        "Apple",
        "AI",
        "node traffic"
      ],
      "references": [
        "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
        "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
        "http://truefoundry.prodigaltech.com/",
        "git.spywarewatchdog.org",
        "marriott-control-prd.accenture.cn",
        "marriott-datacenter-prd.accenture.cn",
        "accenture.cn",
        "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
        "target.id  \u2022 tostring.call  \u2022 title.search",
        "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
        "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
        "http://truefoundry.prodigaltech.com/",
        "Attacker being used by several legal entities attacking a target\u2019s family",
        "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
        "Luxury Apartments and Townhome communities do use Foundry Palantir",
        "Some Colorado communities have been taken over by the State Government",
        "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
        "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
        "Foundry Foot Soldiers are still in Colorado targeting innocents",
        "Foundry Palantir still has a presence in Colorado",
        "I need some help.",
        "Accurately tipped about air travel safety. In past. Proven true.",
        "Tipped of new looming airline threats",
        "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
        "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
        "FBI files opened up on a targeted phone, Iunseel, only in search history.",
        "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
        "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
        "Hours after files were deemed malicious. We powered on targeted Smart TV",
        "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
        "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
        "A man claiming to have the name Sebastian is communicating with targets love one",
        "Uses code, no phone calls. Connected via instagram.",
        "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
        "By remote view of NEW targeys view, all key calls are routed through him.",
        "Targets associated warned. Not very open to advice.",
        "I would post his public information. It may be unwise.",
        "Connects to all NEW targets key contacts main targets contacts.",
        "We have foot soldiers. Be aware",
        "https://www.justice.gov/opa/pr/departmen.t",
        "https://api.manus.im/api/oauth2_callback/apple",
        "https://apple.btprmjo.cc/",
        "https://creative.miqdigital.com/.well-known/apple-app-site-association",
        "internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
        "http://www.internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
        "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
        "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Node Traffic",
          "display_name": "Node Traffic",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1055.011",
          "name": "Extra Window Memory Injection",
          "display_name": "T1055.011 - Extra Window Memory Injection"
        },
        {
          "id": "T1055.001",
          "name": "Dynamic-link Library Injection",
          "display_name": "T1055.001 - Dynamic-link Library Injection"
        },
        {
          "id": "T1055.004",
          "name": "Asynchronous Procedure Call",
          "display_name": "T1055.004 - Asynchronous Procedure Call"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1055.014",
          "name": "VDSO Hijacking",
          "display_name": "T1055.014 - VDSO Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5643,
        "domain": 700,
        "hostname": 1918,
        "FileHash-SHA256": 1161,
        "FileHash-MD5": 235,
        "email": 4,
        "FileHash-SHA1": 200,
        "CVE": 1,
        "CIDR": 2,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 9873,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "64 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69aa019f4509897e354fe029",
      "name": "credit Q Vashti Cloned Pulse ",
      "description": "",
      "modified": "2026-03-29T20:03:36.333000",
      "created": "2026-03-05T22:20:15.324000",
      "tags": [
        "pattern match",
        "heuristic match",
        "all url",
        "files domain",
        "pulses otx",
        "germany unknown",
        "aaaa",
        "ip address",
        "emails",
        "gmt server",
        "vary",
        "modified",
        "accept",
        "title",
        "present feb",
        "present jan",
        "united",
        "part",
        "moved",
        "passive dns",
        "cname",
        "final",
        "bill",
        "antivm",
        "xlsx",
        "xlsm",
        "urls",
        "otx logo",
        "all hostname",
        "server",
        "organization",
        "city",
        "stateprovince",
        "postal code",
        "phone",
        "registrar abuse",
        "privacy admin",
        "paris admin",
        "april",
        "direct",
        "february",
        "http",
        "dfn verein",
        "zur foerderung",
        "domain",
        "page url",
        "tags",
        "de summary",
        "erlangen",
        "germany",
        "securitytrails",
        "de seen",
        "general info",
        "geo erlangen",
        "as as680",
        "de note",
        "route",
        "data upload",
        "extraction",
        "failed",
        "extra data",
        "referen",
        "include review",
        "exclude data",
        "summary",
        "url age",
        "as680",
        "se source",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "over",
        "ascii text",
        "mitre att",
        "size",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "node traffic",
        "tlsv1",
        "search",
        "rgba",
        "medium",
        "read c",
        "module load",
        "t1129",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "calls",
        "apis",
        "reads",
        "model",
        "value",
        "getprocaddress",
        "show technique",
        "ck matrix",
        "access type",
        "windir",
        "regexp",
        "open",
        "date",
        "format",
        "virtual disk drive",
        "sha256",
        "sha1",
        "body",
        "filehashsha1",
        "found",
        "unknown",
        "stop",
        "root",
        "form",
        "9999",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "bad traffic",
        "et info",
        "tls handshake",
        "failure",
        "flag",
        "analysis tip",
        "openurl c",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "show",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious yara",
        "detections none",
        "less ip",
        "dynamicloader",
        "get na",
        "c3bhaw",
        "high",
        "copy",
        "guard",
        "push",
        "Palantir",
        "Foundry",
        "Whitehouse",
        "X.Com",
        "Justice.gov",
        "Apple",
        "AI",
        "node traffic"
      ],
      "references": [
        "tor.sebastianhahn.net \u2022 dap.digitalgov.gov \u2022 fbi.gov \u2022  x.com \u2022 sebastianhahn.net",
        "https://tor.sebastianhahn.net \u2022 faui2k9.de\t \u2022 gitbot.faui2k9.de \u2022 tor-dirauth.sebastianhahn.net \u2022",
        "http://truefoundry.prodigaltech.com/",
        "git.spywarewatchdog.org",
        "marriott-control-prd.accenture.cn",
        "marriott-datacenter-prd.accenture.cn",
        "accenture.cn",
        "c.j.location.host \u2022 videodata.video \u2022 referrer.search",
        "target.id  \u2022 tostring.call  \u2022 title.search",
        "https://hybrid-analysis.com/sample/2f05feed2065b7385b156ebf3a7c6c19def3d412227cee0d46e8a53fb3e9ac41/697bc423b6e7a4dc46010737",
        "https://hybrid-analysis.com/sample/430c376c1754f1f160e3d68bafc970eba37811bdb08d73a86bf6f4be1e7267b3/69a1ea603a3303fa120dad19",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70/69a19551cb5537805706bca9",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70",
        "calathea-containers.palantirfedstart.com \u2018 BYE ALREADY\u2019",
        "http://truefoundry.prodigaltech.com/",
        "Attacker being used by several legal entities attacking a target\u2019s family",
        "Clyde &Co | Chris Ahmann | Brian Sabey /Hall & Evans & Hall Render",
        "Luxury Apartments and Townhome communities do use Foundry Palantir",
        "Some Colorado communities have been taken over by the State Government",
        "Quasi Government: Specifically Pinnacol and Commerce & Industry ( AIG)",
        "Denver Justice System. Palantir allegedly moved  potato Headquarters to Miami",
        "Foundry Foot Soldiers are still in Colorado targeting innocents",
        "Foundry Palantir still has a presence in Colorado",
        "I need some help.",
        "Accurately tipped about air travel safety. In past. Proven true.",
        "Tipped of new looming airline threats",
        "Tipped on hits and other savage plans  to be executed against targets. Targets can be any (1) person.",
        "Sound crazy. We know Palantir commits ALL manner of crime. They are money motivated.",
        "FBI files opened up on a targeted phone, Iunseel, only in search history.",
        "Air Safety: it\u2019s important to have  passengers or hackers unable  to communicate via airline networks /",
        "No phones or circuit board tech. Smart watches.You can\u2019t bring large bottles of hygiene products. Deal with a new reality!",
        "Hours after files were deemed malicious. We powered on targeted Smart TV",
        "You have to go through a series of steps to change themes and wallpapers , including powering off TV",
        "Significant? The screen once had a floral theme. Now a black background with a single fish as Wallpaper .",
        "A man claiming to have the name Sebastian is communicating with targets love one",
        "Uses code, no phone calls. Connected via instagram.",
        "I\u2019m not sure what brings man to from NY to Denver today. I consider him malicious",
        "By remote view of NEW targeys view, all key calls are routed through him.",
        "Targets associated warned. Not very open to advice.",
        "I would post his public information. It may be unwise.",
        "Connects to all NEW targets key contacts main targets contacts.",
        "We have foot soldiers. Be aware",
        "https://www.justice.gov/opa/pr/departmen.t",
        "https://api.manus.im/api/oauth2_callback/apple",
        "https://apple.btprmjo.cc/",
        "https://creative.miqdigital.com/.well-known/apple-app-site-association",
        "internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/2017-04-03-IFR-2017.pdf",
        "http://www.internationalfrontier.com",
        "http://www.internationalfrontier.com/i/pdf/Montana-Presentation-2011.pdf",
        "https://tylerjoycedenver.followupboss.com/unsubscribe/T6pEHkEaLZAN5Jxflvspix0zKbJZwfY9pjBpUTk7q06azxItZ7aiRb7brQhy1NNFqrcrUe4cKmI455MBqcwK9_it6dqx6QWdANshp0om1Bv-5ezKkyVJDphCHvPQNvMupI1owe03rtqYAyu8Cj3cWw~~",
        "Related to: https://otx.alienvault.com/pulse/69a1a73eb0578b92962dae97"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Node Traffic",
          "display_name": "Node Traffic",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1055.011",
          "name": "Extra Window Memory Injection",
          "display_name": "T1055.011 - Extra Window Memory Injection"
        },
        {
          "id": "T1055.001",
          "name": "Dynamic-link Library Injection",
          "display_name": "T1055.001 - Dynamic-link Library Injection"
        },
        {
          "id": "T1055.004",
          "name": "Asynchronous Procedure Call",
          "display_name": "T1055.004 - Asynchronous Procedure Call"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1055.014",
          "name": "VDSO Hijacking",
          "display_name": "T1055.014 - VDSO Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69a2127d12dce12538b57d72",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5644,
        "domain": 701,
        "hostname": 1920,
        "FileHash-SHA256": 1161,
        "FileHash-MD5": 235,
        "email": 4,
        "FileHash-SHA1": 200,
        "CVE": 1,
        "CIDR": 2,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 9877,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "64 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.xiancloudxian.top/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.xiancloudxian.top/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780390321.562807
}