{
  "type": "URL",
  "indicator": "https://yom.net/privacy",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://yom.net/privacy",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4256565608,
      "indicator": "https://yom.net/privacy",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69bf261cc4e399447d78776c",
          "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
          "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
          "modified": "2026-04-20T21:01:07.869000",
          "created": "2026-03-21T23:13:32.760000",
          "tags": [
            "sc data",
            "data upload",
            "please sub",
            "include data",
            "extraction",
            "failed",
            "sc pulse",
            "idron anv",
            "extr please",
            "include review",
            "exclude sugges",
            "stop show",
            "typ domain",
            "united",
            "virtool",
            "name servers",
            "cryp",
            "emails",
            "win32",
            "ip address",
            "worm",
            "trojan",
            "learn",
            "suspicious",
            "informative",
            "ck id",
            "name tactics",
            "command",
            "adversaries",
            "spawns",
            "ssl certificate",
            "initial access",
            "link initial",
            "prefetch8",
            "mitre att",
            "ck matrix",
            "flag",
            "windows nt",
            "win64",
            "accept",
            "encrypt",
            "form",
            "hybrid",
            "bypass",
            "general",
            "path",
            "iframe",
            "click",
            "strings",
            "anchor https",
            "anchor",
            "liberal",
            "sabey",
            "liberal friends",
            "meta",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "info initial",
            "access ta0001",
            "compromise",
            "t1189 network",
            "communication",
            "get http",
            "artifacts v",
            "full reports",
            "v get",
            "help dns",
            "resolutions",
            "ip traffic",
            "extr data",
            "enter sc",
            "extra data",
            "referen",
            "broth",
            "passive dns",
            "urls",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "none google",
            "safe browsing",
            "inquest labs",
            "lucas acha",
            "code integrity",
            "checks creation",
            "otx logo",
            "all hostname",
            "files",
            "domain",
            "protect",
            "date",
            "title",
            "exchange",
            "se http",
            "present jan",
            "present feb",
            "present dec",
            "backdoor",
            "certificate",
            "all domain",
            "alibaba cloud",
            "hichina",
            "porkbun llc",
            "cloudflare",
            "namecheap inc",
            "namecheap",
            "domains",
            "dynadot llc",
            "ascio",
            "denmark",
            "url https",
            "filehashsha256",
            "url http",
            "dopple ai",
            "snit",
            "iocs",
            "otx description",
            "information",
            "report spam",
            "delete service",
            "poem",
            "hunter",
            "malicious",
            "porn revenge",
            "brian sabeys",
            "all report",
            "spam delete",
            "rl http",
            "https",
            "expiration http",
            "spam brian",
            "swipper",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashmd5",
            "filehashsha1",
            "sha256",
            "scan",
            "learn more",
            "indicators show",
            "tbmvid",
            "sourcelnms",
            "zx1724209326040",
            "xxx videos",
            "xxxvideohd",
            "adversary",
            "packing",
            "palantir.com",
            "discovery",
            "victim won case",
            "doin it",
            "palantirian abuse",
            "apple",
            "sabey data centers",
            "insurance",
            "quasi government",
            "the brother sabey",
            "reimer",
            "law enforcement",
            "vessel state",
            "sabey porn",
            "hall evans",
            "christopher ahmann",
            "defamation",
            "google"
          ],
          "references": [
            "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
            "http://watchhers.net/index.php",
            "http://212.33.237.86/images/1/report.php",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://webmail.police.govmm.org/owa/",
            "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
            "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
            "Mark Brian Sabey",
            "Melvin Sabey",
            "Christopher P \u2018Buzz\u2019 Ahmann",
            "Ronda Cordova",
            "Unknown Persons impersonating Private Investigators (plural)",
            "Quasi Government Case",
            "Victim silenced. Struck by Car Driven by male police let walk",
            "Denver Police let this attempted murder walk. Cited him as a ghost driver",
            "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
            "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
            "Reimer was a PT. Unknown whereabouts , name or job description",
            "Denver Police Department Major Crimes closed investigation",
            "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
            "I bring up the personal nature of the crime because a delete service has been used",
            "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
            "All IoC\u2019s originate from sources named. There are some unknown attackers",
            "This is a serious crime. I\u2019m certain God WILL pay them.",
            "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
            "http://palantirwww.sweetheartvideo.com/ (weirdness)",
            "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.datafoundry.com/data-center-contamination-control/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2-lbl.dvr.dn2.n-helix.com/",
            "https://207-207-25-201.fwd.datafoundry.com/",
            "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
            "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
            "https://rdweb.datafoundry.com/",
            "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
            "http://foundry2sdbl.dvr.dn2.n-helix.com/",
            "Updated | What\u2019s left after theft",
            "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
            "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
            "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
            "https://www.datafoundry.com/category/news/press-releases/",
            "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
            "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
            "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
            "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
            "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
            "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
            "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
            "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
            "Some may may find this content is very disturbing and offensive"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Porn Revenge",
              "display_name": "Porn Revenge",
              "target": null
            },
            {
              "id": "Tons of Malware",
              "display_name": "Tons of Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1132.001",
              "name": "Standard Encoding",
              "display_name": "T1132.001 - Standard Encoding"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1495",
              "name": "Firmware Corruption",
              "display_name": "T1495 - Firmware Corruption"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1586.001",
              "name": "Social Media Accounts",
              "display_name": "T1586.001 - Social Media Accounts"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6034,
            "domain": 1422,
            "FileHash-MD5": 274,
            "FileHash-SHA1": 252,
            "FileHash-SHA256": 3378,
            "email": 11,
            "hostname": 2753,
            "CVE": 1,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 14134,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "42 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69afd95e9073ee0f67be8694",
          "name": "URLSpirit Spyware | Targeted Device attacks | MITM attacks | AI and Browser Attacks",
          "description": "",
          "modified": "2026-04-09T08:02:04.521000",
          "created": "2026-03-10T08:42:06.133000",
          "tags": [
            "msie",
            "chrome",
            "search",
            "united",
            "unknown ns",
            "taiwan unknown",
            "requested range",
            "ip address",
            "taiwan",
            "title",
            "tlsv1",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "stcalifornia",
            "lmountain view",
            "ogoogle llc",
            "unknown",
            "encrypt",
            "malware",
            "suspicious",
            "learn",
            "informative",
            "ck id",
            "name tactics",
            "command",
            "spawns",
            "found",
            "id name",
            "malicious",
            "over",
            "ascii text",
            "pattern match",
            "mitre att",
            "size",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "http",
            "data upload",
            "enter scords",
            "one on",
            "extraction",
            "http request",
            "checkin",
            "observed dns",
            "query",
            "dns query",
            "domain",
            "lila windows",
            "all se",
            "file version",
            "product vers",
            "failed",
            "included ic",
            "review iocs",
            "ic data",
            "status",
            "ch ua",
            "emails",
            "servers",
            "for privacy",
            "record value",
            "trojan",
            "pegasus",
            "body",
            "palantir",
            "se antivirus",
            "ids deted",
            "domains",
            "tachnalnav dan",
            "origin",
            "pe versio",
            "include review",
            "exclude sugges",
            "stop data",
            "q search",
            "product",
            "contact data",
            "contact urlspirit",
            "url http",
            "hostname",
            "url https",
            "stop show",
            "types",
            "type",
            "indicator",
            "defense evasion",
            "sha1",
            "legalcopyngn",
            "copyugnt zur",
            "fileversic data",
            "exclude data",
            "no expiration",
            "ipv4",
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "macintosh",
            "khtml",
            "type indicator",
            "iocs",
            "sc type",
            "hong kong",
            "certificate",
            "enterprise",
            "adversaries",
            "evasion att",
            "urlspirit",
            "targeted att",
            "monitored target",
            "browser attacks",
            "ai chat",
            "next level",
            "quasi",
            "apple",
            "android",
            "windows"
          ],
          "references": [
            "Exploit Source: 210.64.137.210 | IP\u4f4d\u5740\u8cc7\u8a0a\uff08210.64.0.0 tw.ntunhs.net)",
            "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
            "Antivirus Detections: Win.Trojan.Agent-1190546",
            "IDS Detections: URLSpirit Spyware Checkin Observed DNS Query to Suspicious Domain adz2you[.]com",
            "IDS Detections: DNS Query for Suspicious .cf Domain HTTP Request to a *.xyz domain",
            "Alerts: network_icmp persistence_autorun disables_proxy modifies_certificates",
            "Alerts: modifies_proxy_wpad  ransomware_dropped_files ransomware_mass_file_delete",
            "Alerts: dumped_buffer network_cnc_http network_http network_http_post suspicious_tld",
            "Alerts: allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
            "Alerts: origin_langid creates_exe injection_process_search multiple_useragents",
            "Domains Contacted: r4---sn-5goeen7d.googlevideo.com s23.cnzz.com www.youtube.com",
            "Domains Contacted: c.cnzz.com crl.comodoca4.com ocsp2.globalsign.com a.exdynsrv.com",
            "Domains Contacted: www.wanuu2.club xml.admidainsight.com www.gstatic.com .",
            "Indicator deletion during pulse | Requires more research | Positive for MITM attack",
            "IP\u2019s Contacted: 103.23.108.110  103.23.108.112  103.23.108.114  103.23.108.124  103.23.108.140",
            "IP\u2019s Contacted: 103.23.108.184  103.23.108.220  103.23.108.80  103.23.108.92  104.18.20.226",
            "URLSpirit Spyware",
            "Palantir\u2019s PIT - Prometheus Intelligence Technology Damaging Spyware distribution, AI Man in the Middle Attacks",
            "Origin: https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
            "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
            "PE Version Information :  LegalCopyright: Copyright 2012 Spiritsoft All Rights Reserved. InternalName\tjingling.exe",
            "FileVersion: 2013.10.10.100 Company Name: \u7cbe\u7075\u8f6f\u4ef6 Comments: \u6d41\u91cf\u7cbe\u7075(1094) ProductName: \u6d41\u91cf\u7cbe\u7075",
            "Product Version: 4.0.3.1 File Description: \u6d41\u91cf\u7cbe\u7075 Original File name: jingling.exe",
            "023097.palantir.events \u2022 palantir.events \u2022 url3561.palantir.events",
            "13.32.178.127 \u2022 023097.palantir.events \u2022 palantir.events \u2022 Email admin@dnstinations.com",
            "www.palantir.events  \u2022 Email cirt@palantir.com \u2022 0055-b2b-nonprod-bigip1.palantir.events \u2022",
            "151-80-200-88.palantir.events \u2022 196-196-19-74.palantir.events",
            "http://www.net-chinese.com.tw \u2022 pixanalytics.com \u2022 pixnet.cc \u2022 pixnet.tv",
            "quecompegasune.tk \u2022 hipicapegaso.com",
            "This is part of a Prometheus Intelligence Technology (PIT) Palantir Attack",
            "Incredibly false information, white screens , pink screens and chat erasure",
            "Definitely requires further research",
            "Pegasus Indicators deleted during pulse"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Malaysia"
          ],
          "malware_families": [
            {
              "id": "URLSpirit",
              "display_name": "URLSpirit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1608.004",
              "name": "Drive-by Target",
              "display_name": "T1608.004 - Drive-by Target"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1428",
              "name": "Exploit Enterprise Resources",
              "display_name": "T1428 - Exploit Enterprise Resources"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            }
          ],
          "industries": [
            "Technology",
            "Government",
            "Defense"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 406,
            "FileHash-SHA1": 391,
            "FileHash-SHA256": 5770,
            "URL": 7299,
            "domain": 1307,
            "email": 13,
            "hostname": 2162,
            "CVE": 3,
            "SSLCertFingerprint": 45
          },
          "indicator_count": 17396,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "54 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "https://webmail.police.govmm.org/owa/",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "IP\u2019s Contacted: 103.23.108.110  103.23.108.112  103.23.108.114  103.23.108.124  103.23.108.140",
        "http://212.33.237.86/images/1/report.php",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "IP\u2019s Contacted: 103.23.108.184  103.23.108.220  103.23.108.80  103.23.108.92  104.18.20.226",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "Alerts: origin_langid creates_exe injection_process_search multiple_useragents",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "Melvin Sabey",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "http://www.net-chinese.com.tw \u2022 pixanalytics.com \u2022 pixnet.cc \u2022 pixnet.tv",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "13.32.178.127 \u2022 023097.palantir.events \u2022 palantir.events \u2022 Email admin@dnstinations.com",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "Alerts: allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "URLSpirit Spyware",
        "I bring up the personal nature of the crime because a delete service has been used",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "Mark Brian Sabey",
        "Pegasus Indicators deleted during pulse",
        "Some may may find this content is very disturbing and offensive",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Antivirus Detections: Win.Trojan.Agent-1190546",
        "Quasi Government Case",
        "Updated | What\u2019s left after theft",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "Domains Contacted: r4---sn-5goeen7d.googlevideo.com s23.cnzz.com www.youtube.com",
        "quecompegasune.tk \u2022 hipicapegaso.com",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Product Version: 4.0.3.1 File Description: \u6d41\u91cf\u7cbe\u7075 Original File name: jingling.exe",
        "023097.palantir.events \u2022 palantir.events \u2022 url3561.palantir.events",
        "Alerts: dumped_buffer network_cnc_http network_http network_http_post suspicious_tld",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "www.palantir.events  \u2022 Email cirt@palantir.com \u2022 0055-b2b-nonprod-bigip1.palantir.events \u2022",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "Alerts: network_icmp persistence_autorun disables_proxy modifies_certificates",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "Domains Contacted: www.wanuu2.club xml.admidainsight.com www.gstatic.com .",
        "Definitely requires further research",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "Incredibly false information, white screens , pink screens and chat erasure",
        "https://rdweb.datafoundry.com/",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "Origin: https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "This is part of a Prometheus Intelligence Technology (PIT) Palantir Attack",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "FileVersion: 2013.10.10.100 Company Name: \u7cbe\u7075\u8f6f\u4ef6 Comments: \u6d41\u91cf\u7cbe\u7075(1094) ProductName: \u6d41\u91cf\u7cbe\u7075",
        "IDS Detections: DNS Query for Suspicious .cf Domain HTTP Request to a *.xyz domain",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "Denver Police Department Major Crimes closed investigation",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "http://watchhers.net/index.php",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "Palantir\u2019s PIT - Prometheus Intelligence Technology Damaging Spyware distribution, AI Man in the Middle Attacks",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "IDS Detections: URLSpirit Spyware Checkin Observed DNS Query to Suspicious Domain adz2you[.]com",
        "Indicator deletion during pulse | Requires more research | Positive for MITM attack",
        "Ronda Cordova",
        "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "Alerts: modifies_proxy_wpad  ransomware_dropped_files ransomware_mass_file_delete",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "Unknown Persons impersonating Private Investigators (plural)",
        "Domains Contacted: c.cnzz.com crl.comodoca4.com ocsp2.globalsign.com a.exdynsrv.com",
        "151-80-200-88.palantir.events \u2022 196-196-19-74.palantir.events",
        "Exploit Source: 210.64.137.210 | IP\u4f4d\u5740\u8cc7\u8a0a\uff08210.64.0.0 tw.ntunhs.net)",
        "https://www.datafoundry.com/category/news/press-releases/",
        "PE Version Information :  LegalCopyright: Copyright 2012 Spiritsoft All Rights Reserved. InternalName\tjingling.exe"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Tons of malware",
            "Porn revenge",
            "Urlspirit"
          ],
          "industries": [
            "Technology",
            "Defense",
            "Government"
          ],
          "unique_indicators": 32460
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/yom.net",
    "whois": "http://whois.domaintools.com/yom.net",
    "domain": "yom.net",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69bf261cc4e399447d78776c",
      "name": "Cyber Bully Attackers | Revenge Attacks | Remote attackers | Malware Packed |",
      "description": "Several government entities, attorneys have sought porn revenge including physical violence, attempted crimes, malicious prosecution case , harassment when a female patient of man formerly known as Jeffrey Scott Reimer of Chester Springs, PA, violently, critically injured patient in a sexually charged assault [URL\thttp://foundry2-lbl.dvr.dn2.n-helix.com\t\t\t\nhttps://foundry2-lbl.dvr.dn2.n-helix.com\t\tfoundry2-lbl.dvr.dn2.n-helix.com\t\t\t\t\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\nhttp://datafoundry.com\t\t\t\nhttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\thttps://209-99-40-223.fwd.datafoundry.com\t\t\t\ndatafoundry.com",
      "modified": "2026-04-20T21:01:07.869000",
      "created": "2026-03-21T23:13:32.760000",
      "tags": [
        "sc data",
        "data upload",
        "please sub",
        "include data",
        "extraction",
        "failed",
        "sc pulse",
        "idron anv",
        "extr please",
        "include review",
        "exclude sugges",
        "stop show",
        "typ domain",
        "united",
        "virtool",
        "name servers",
        "cryp",
        "emails",
        "win32",
        "ip address",
        "worm",
        "trojan",
        "learn",
        "suspicious",
        "informative",
        "ck id",
        "name tactics",
        "command",
        "adversaries",
        "spawns",
        "ssl certificate",
        "initial access",
        "link initial",
        "prefetch8",
        "mitre att",
        "ck matrix",
        "flag",
        "windows nt",
        "win64",
        "accept",
        "encrypt",
        "form",
        "hybrid",
        "bypass",
        "general",
        "path",
        "iframe",
        "click",
        "strings",
        "anchor https",
        "anchor",
        "liberal",
        "sabey",
        "liberal friends",
        "meta",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "info initial",
        "access ta0001",
        "compromise",
        "t1189 network",
        "communication",
        "get http",
        "artifacts v",
        "full reports",
        "v get",
        "help dns",
        "resolutions",
        "ip traffic",
        "extr data",
        "enter sc",
        "extra data",
        "referen",
        "broth",
        "passive dns",
        "urls",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "none google",
        "safe browsing",
        "inquest labs",
        "lucas acha",
        "code integrity",
        "checks creation",
        "otx logo",
        "all hostname",
        "files",
        "domain",
        "protect",
        "date",
        "title",
        "exchange",
        "se http",
        "present jan",
        "present feb",
        "present dec",
        "backdoor",
        "certificate",
        "all domain",
        "alibaba cloud",
        "hichina",
        "porkbun llc",
        "cloudflare",
        "namecheap inc",
        "namecheap",
        "domains",
        "dynadot llc",
        "ascio",
        "denmark",
        "url https",
        "filehashsha256",
        "url http",
        "dopple ai",
        "snit",
        "iocs",
        "otx description",
        "information",
        "report spam",
        "delete service",
        "poem",
        "hunter",
        "malicious",
        "porn revenge",
        "brian sabeys",
        "all report",
        "spam delete",
        "rl http",
        "https",
        "expiration http",
        "spam brian",
        "swipper",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashmd5",
        "filehashsha1",
        "sha256",
        "scan",
        "learn more",
        "indicators show",
        "tbmvid",
        "sourcelnms",
        "zx1724209326040",
        "xxx videos",
        "xxxvideohd",
        "adversary",
        "packing",
        "palantir.com",
        "discovery",
        "victim won case",
        "doin it",
        "palantirian abuse",
        "apple",
        "sabey data centers",
        "insurance",
        "quasi government",
        "the brother sabey",
        "reimer",
        "law enforcement",
        "vessel state",
        "sabey porn",
        "hall evans",
        "christopher ahmann",
        "defamation",
        "google"
      ],
      "references": [
        "The Brothers Sabey \u2013 Conservatives with Liberal Friends \u2022 https://thebrotherssabey.com/",
        "http://watchhers.net/index.php",
        "http://212.33.237.86/images/1/report.php",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://webmail.police.govmm.org/owa/",
        "https://pks.wroclaw.sa.gov.pl:1443/ \u2022 portal.bialystok.sa.gov.pl",
        "https://tulach.cc/ phishing \u2022 45.32.112.220 scanning_host \u2022 45.76.79.215",
        "Mark Brian Sabey",
        "Melvin Sabey",
        "Christopher P \u2018Buzz\u2019 Ahmann",
        "Ronda Cordova",
        "Unknown Persons impersonating Private Investigators (plural)",
        "Quasi Government Case",
        "Victim silenced. Struck by Car Driven by male police let walk",
        "Denver Police let this attempted murder walk. Cited him as a ghost driver",
        "Make driver stuck victim with large vehicle after PT unknowingly reported original assault Jeffrey Reiner to Dora",
        "Sexual and Physical Assaulter - Jeffrey Scott Reimer",
        "Reimer was a PT. Unknown whereabouts , name or job description",
        "Denver Police Department Major Crimes closed investigation",
        "Investigation closed when Brian Sabey initiated a malicious prosecution case against Victim",
        "I bring up the personal nature of the crime because a delete service has been used",
        "More than 1000 IoC\u2019s including pulses have been ILLEGALLY removed",
        "All IoC\u2019s originate from sources named. There are some unknown attackers",
        "This is a serious crime. I\u2019m certain God WILL pay them.",
        "https://palantirwww.sweetheartvideo.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t3\t  domain\tpalantir.io\t\t\tMar 21, 2026, 2:06:10 PM\t\t34\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/ \u2022 www.palantir.com",
        "http://palantirwww.sweetheartvideo.com/ (weirdness)",
        "http://foundry2-lbl.dvr.dn2.n-helix.com \u2022 https://foundry2-lbl.dvr.dn2.n-helix.com",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "foundry2-lbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t29\t  URL\thttps://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  URL\thttp://datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t9\t  URL\thttp://foundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t17\t  URL\thttps://209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t27\t  domain\tdatafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t40\t  hostname\t209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/RDWeb/Pages/en-US/login.aspx",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.datafoundry.com/data-center-contamination-control/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2-lbl.dvr.dn2.n-helix.com/",
        "https://207-207-25-201.fwd.datafoundry.com/",
        "http://datafoundry.com \u2022 http://foundry2sdbl.dvr.dn2.n-helix.com \u2022 https://209-99-40-223.fwd.datafoundry.com \u2022 datafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com \u2022 beabetta.ifoundry.co.uk.s7b2.psmtp.com \u2022 foundry2sdbl.dvr.dn2.n-helix.com \u2022 fwd.datafoundry.com \u2022 207-207-25-154.fwd.datafoundry.com \u2022 207-207-25-156.fwd.datafoundry.com\t\t\t207-207-25-160.fwd.datafoundry.com \u2022 207-207-25-163.fwd.datafoundry.com  \u2022\t207-207-25-164.fwd.datafoundry.com \u2022 207-207-25-165.fwd.datafoundry.com\t\t\tMar 21, 207-207-25-166.fwd",
        "http://datafoundry.com \u2022 https://209-99-40-223.fwd.datafoundry.com\tdatafoundry.com \u2022 209-99-40-223.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t13\t  hostname\tbeabetta.ifoundry.co.uk.s7b2.psmtp.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t12\t  hostname\tfoundry2sdbl.dvr.dn2.n-helix.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t18\t  hostname\tfwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t8\t  hostname\t207-207-25-154.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:10 PM\t\t19\t  hostname\t207-207-25-156.fwd.datafoundry.com\t\t\tMar 21, 2026, 2:06:1",
        "https://rdweb.datafoundry.com/",
        "https://www.palantir.io/docs/foundry/ontologies/test-changes-in-ontology/",
        "http://foundry2sdbl.dvr.dn2.n-helix.com/",
        "Updated | What\u2019s left after theft",
        "207-207-25-167.fwd.datafoundry.com \u2022 207-207-25-168.fwd.datafoundry.com \u2022 207-207-25-169.fwd.datafoundry.com",
        "207-207-25-170.fwd.datafoundry.com \u2022 207-207-25-171.fwd.datafoundry.com \u2022 207-207-25-201.fwd.datafoundry.com",
        "https://www.datafoundry.com/category/news/press-releases/ (Fake Press) abuse",
        "https://www.datafoundry.com/category/news/press-releases/",
        "207-207-25-209.fwd.datafoundry.com \u2022\t207-207-25-212.fwd.datafoundry.com \u2022 207-207-25-213.fwd.datafoundry.com \u2022 209-99-64-53.fwd.datafoundry.com",
        "209-99-69-91.fwd.datafoundry.com \u2022 dns1.datafoundry.com \u2022 dns2.datafoundry.com \u2022 rdweb.datafoundry.com",
        "www.go.datafoundry.com \u2022 http://207-207-25-209.fwd.datafoundry.com",
        "http://209-99-64-53.fwd.datafoundry.com \u2022 http://dns2.datafoundry.com \u2022 http://fwd.datafoundry.com",
        "http://pdns1.datafoundry.com/ \u2022\thttp://rdweb.datafoundry.com \u2022 http://rdweb.datafoundry.com/",
        "https://rdweb.datafoundry.com/ \u2022 http://www.datafoundry.com \u2022 https://207-207-25-163.fwd.datafoundry.com \u2022",
        "https://207-207-25-209.fwd.datafoundry.com \u2022 https://209-99-40-224.fwd.datafoundry.com/",
        "https://209-99-64-53.fwd.datafoundry.com \u2022 https://dns1.datafoundry.com \u2022 https://dns2.datafoundry.com \u2022 https://fwd.datafoundry.com",
        "Some may may find this content is very disturbing and offensive"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Porn Revenge",
          "display_name": "Porn Revenge",
          "target": null
        },
        {
          "id": "Tons of Malware",
          "display_name": "Tons of Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1132.001",
          "name": "Standard Encoding",
          "display_name": "T1132.001 - Standard Encoding"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1495",
          "name": "Firmware Corruption",
          "display_name": "T1495 - Firmware Corruption"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1586.001",
          "name": "Social Media Accounts",
          "display_name": "T1586.001 - Social Media Accounts"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6034,
        "domain": 1422,
        "FileHash-MD5": 274,
        "FileHash-SHA1": 252,
        "FileHash-SHA256": 3378,
        "email": 11,
        "hostname": 2753,
        "CVE": 1,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 14134,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "42 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69afd95e9073ee0f67be8694",
      "name": "URLSpirit Spyware | Targeted Device attacks | MITM attacks | AI and Browser Attacks",
      "description": "",
      "modified": "2026-04-09T08:02:04.521000",
      "created": "2026-03-10T08:42:06.133000",
      "tags": [
        "msie",
        "chrome",
        "search",
        "united",
        "unknown ns",
        "taiwan unknown",
        "requested range",
        "ip address",
        "taiwan",
        "title",
        "tlsv1",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "stcalifornia",
        "lmountain view",
        "ogoogle llc",
        "unknown",
        "encrypt",
        "malware",
        "suspicious",
        "learn",
        "informative",
        "ck id",
        "name tactics",
        "command",
        "spawns",
        "found",
        "id name",
        "malicious",
        "over",
        "ascii text",
        "pattern match",
        "mitre att",
        "size",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "http",
        "data upload",
        "enter scords",
        "one on",
        "extraction",
        "http request",
        "checkin",
        "observed dns",
        "query",
        "dns query",
        "domain",
        "lila windows",
        "all se",
        "file version",
        "product vers",
        "failed",
        "included ic",
        "review iocs",
        "ic data",
        "status",
        "ch ua",
        "emails",
        "servers",
        "for privacy",
        "record value",
        "trojan",
        "pegasus",
        "body",
        "palantir",
        "se antivirus",
        "ids deted",
        "domains",
        "tachnalnav dan",
        "origin",
        "pe versio",
        "include review",
        "exclude sugges",
        "stop data",
        "q search",
        "product",
        "contact data",
        "contact urlspirit",
        "url http",
        "hostname",
        "url https",
        "stop show",
        "types",
        "type",
        "indicator",
        "defense evasion",
        "sha1",
        "legalcopyngn",
        "copyugnt zur",
        "fileversic data",
        "exclude data",
        "no expiration",
        "ipv4",
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "macintosh",
        "khtml",
        "type indicator",
        "iocs",
        "sc type",
        "hong kong",
        "certificate",
        "enterprise",
        "adversaries",
        "evasion att",
        "urlspirit",
        "targeted att",
        "monitored target",
        "browser attacks",
        "ai chat",
        "next level",
        "quasi",
        "apple",
        "android",
        "windows"
      ],
      "references": [
        "Exploit Source: 210.64.137.210 | IP\u4f4d\u5740\u8cc7\u8a0a\uff08210.64.0.0 tw.ntunhs.net)",
        "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "Antivirus Detections: Win.Trojan.Agent-1190546",
        "IDS Detections: URLSpirit Spyware Checkin Observed DNS Query to Suspicious Domain adz2you[.]com",
        "IDS Detections: DNS Query for Suspicious .cf Domain HTTP Request to a *.xyz domain",
        "Alerts: network_icmp persistence_autorun disables_proxy modifies_certificates",
        "Alerts: modifies_proxy_wpad  ransomware_dropped_files ransomware_mass_file_delete",
        "Alerts: dumped_buffer network_cnc_http network_http network_http_post suspicious_tld",
        "Alerts: allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
        "Alerts: origin_langid creates_exe injection_process_search multiple_useragents",
        "Domains Contacted: r4---sn-5goeen7d.googlevideo.com s23.cnzz.com www.youtube.com",
        "Domains Contacted: c.cnzz.com crl.comodoca4.com ocsp2.globalsign.com a.exdynsrv.com",
        "Domains Contacted: www.wanuu2.club xml.admidainsight.com www.gstatic.com .",
        "Indicator deletion during pulse | Requires more research | Positive for MITM attack",
        "IP\u2019s Contacted: 103.23.108.110  103.23.108.112  103.23.108.114  103.23.108.124  103.23.108.140",
        "IP\u2019s Contacted: 103.23.108.184  103.23.108.220  103.23.108.80  103.23.108.92  104.18.20.226",
        "URLSpirit Spyware",
        "Palantir\u2019s PIT - Prometheus Intelligence Technology Damaging Spyware distribution, AI Man in the Middle Attacks",
        "Origin: https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "PE Version Information :  LegalCopyright: Copyright 2012 Spiritsoft All Rights Reserved. InternalName\tjingling.exe",
        "FileVersion: 2013.10.10.100 Company Name: \u7cbe\u7075\u8f6f\u4ef6 Comments: \u6d41\u91cf\u7cbe\u7075(1094) ProductName: \u6d41\u91cf\u7cbe\u7075",
        "Product Version: 4.0.3.1 File Description: \u6d41\u91cf\u7cbe\u7075 Original File name: jingling.exe",
        "023097.palantir.events \u2022 palantir.events \u2022 url3561.palantir.events",
        "13.32.178.127 \u2022 023097.palantir.events \u2022 palantir.events \u2022 Email admin@dnstinations.com",
        "www.palantir.events  \u2022 Email cirt@palantir.com \u2022 0055-b2b-nonprod-bigip1.palantir.events \u2022",
        "151-80-200-88.palantir.events \u2022 196-196-19-74.palantir.events",
        "http://www.net-chinese.com.tw \u2022 pixanalytics.com \u2022 pixnet.cc \u2022 pixnet.tv",
        "quecompegasune.tk \u2022 hipicapegaso.com",
        "This is part of a Prometheus Intelligence Technology (PIT) Palantir Attack",
        "Incredibly false information, white screens , pink screens and chat erasure",
        "Definitely requires further research",
        "Pegasus Indicators deleted during pulse"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Malaysia"
      ],
      "malware_families": [
        {
          "id": "URLSpirit",
          "display_name": "URLSpirit",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1608.004",
          "name": "Drive-by Target",
          "display_name": "T1608.004 - Drive-by Target"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1428",
          "name": "Exploit Enterprise Resources",
          "display_name": "T1428 - Exploit Enterprise Resources"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        }
      ],
      "industries": [
        "Technology",
        "Government",
        "Defense"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 406,
        "FileHash-SHA1": 391,
        "FileHash-SHA256": 5770,
        "URL": 7299,
        "domain": 1307,
        "email": 13,
        "hostname": 2162,
        "CVE": 3,
        "SSLCertFingerprint": 45
      },
      "indicator_count": 17396,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "54 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://yom.net/privacy",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://yom.net/privacy",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780414463.7299588
}