{
  "type": "URL",
  "indicator": "https://zoewu0907.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://zoewu0907.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4149914712,
      "indicator": "https://zoewu0907.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "69b49ad5dd40a24d83cd6a72",
          "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-03-13T23:16:37.716000",
          "created": "2026-03-13T23:16:37.716000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69631fbd16e306ee2b76c4da",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "37 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b496396ca4987e95ad37d1",
          "name": "Chris Buzz by QVashni (wow)",
          "description": "",
          "modified": "2026-03-13T22:56:57.314000",
          "created": "2026-03-13T22:56:57.314000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69482caa00d327da8f0a87bc",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "38 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b49587dd104e342dda1628",
          "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
          "description": "",
          "modified": "2026-03-13T22:53:59.112000",
          "created": "2026-03-13T22:53:59.112000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "38 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "691f4d4ef0a2a570b8b21cd2",
          "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
          "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-11-20T17:18:06.929000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69482caa00d327da8f0a87bc",
          "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-21T17:21:46.434000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "695557ee134b978b00883c29",
          "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2025-12-31T17:05:50.134000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "691f4d4ef0a2a570b8b21cd2",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69631fbd16e306ee2b76c4da",
          "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
          "description": "",
          "modified": "2026-01-20T17:02:02.650000",
          "created": "2026-01-11T03:57:49.242000",
          "tags": [
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "sct1",
            "active",
            "dynamicloader",
            "medium",
            "write c",
            "search",
            "show",
            "high",
            "program gateway",
            "http traffic",
            "http",
            "write",
            "malware",
            "nivdort",
            "serving ip",
            "address",
            "status code",
            "kb body",
            "sha256",
            "gw5hjz7t975",
            "url https",
            "url http",
            "indicator role",
            "pulses url",
            "hostname",
            "poland unknown",
            "present sep",
            "present jul",
            "present may",
            "present apr",
            "present dec",
            "present jan",
            "moved",
            "passive dns",
            "ip address",
            "title",
            "location poland",
            "asn as29522",
            "gmt content",
            "accept encoding",
            "ipv4 add",
            "urls",
            "files",
            "reverse dns",
            "united",
            "record value",
            "aaaa",
            "mtb oct",
            "found",
            "error",
            "read c",
            "memcommit",
            "module load",
            "next",
            "showing",
            "trojan",
            "execution",
            "unknown",
            "entries",
            "ms windows",
            "intel",
            "as15169",
            "codeoverlap",
            "yara detections",
            "delphi",
            "worm",
            "win32",
            "win64",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "script urls",
            "treece alfrey",
            "meta",
            "germany unknown",
            "for privacy",
            "title added",
            "active related",
            "pulses",
            "asnone",
            "named pipe",
            "type indicator",
            "role title",
            "added active",
            "filehashsha256",
            "ally",
            "melika",
            "information",
            "law christopher",
            "https",
            "fake pinterest",
            "tsara",
            "traceback man",
            "expiro",
            "capture",
            "domain",
            "types of",
            "germany",
            "poland",
            "netherlands",
            "cve cve20178977",
            "boobs130432 nov",
            "learn more",
            "filehashmd5",
            "utmsourceawin",
            "pe32",
            "head microsoft",
            "delete",
            "main",
            "backdoor",
            "next associated",
            "gmt connection",
            "control",
            "content type",
            "twitter",
            "certificate",
            "redirect date",
            "cache",
            "unknown ns",
            "hostname add",
            "ipv4",
            "pulse pulses",
            "location united",
            "america flag",
            "america asn",
            "windows",
            "total",
            "ids detections",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "win32mydoom nov",
            "domain add",
            "yara rule",
            "ee fc",
            "ff d5",
            "f0 ff",
            "eb e1",
            "ff ff",
            "c1 e8",
            "c1 c0",
            "eb e8",
            "mpress",
            "cache control",
            "x cache",
            "date",
            "name servers",
            "arial",
            "present aug",
            "present jun",
            "may god",
            "hall render",
            "palantir doing",
            "jeffrey scott",
            "jeffrey reimer",
            "brian sabey",
            "butt pirates",
            "scott reimer",
            "colorado",
            "quasi government",
            "workers compensation",
            "eva lisa",
            "eva reimer",
            "sammie",
            "montano mark",
            "death threats",
            "tulach",
            "hired hit men",
            "gay man",
            "gay porn",
            "concentra",
            "corruption",
            "palantir",
            "foundry",
            "grifter",
            "warning",
            "illegal",
            "apple",
            "contacted",
            "ransom",
            "dead",
            "denver"
          ],
          "references": [
            "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
            "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
            "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
            "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
            "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
            "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
            "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
            "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
            "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "pornhub-e.com \u2022 www.pornhub.com \u2022",
            "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
            "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
            "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
            "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
            "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/model/63710/brandi-love",
            "https://www.sweetheartvideo.com/scenes?models=63710",
            "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
            "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
            "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
            "https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "https://www.vgt.pl/favicon.ico",
            "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
            "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
            "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
            "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
            "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
            "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
            "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
            "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
            "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
            "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
            "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
            "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
            "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
            "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
            "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
            "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
            "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
            "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
            "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
            "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
            "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
            "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://watchhers.net/index.php",
            "remotewd.com device local",
            "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
            "https://browntubeporn.com/tsara-brashearsAccept-Language",
            "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
            "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
            "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
            "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
            "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
            "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Jaik",
              "display_name": "Jaik",
              "target": null
            },
            {
              "id": "Trojan:Win32/Qshell",
              "display_name": "Trojan:Win32/Qshell",
              "target": "/malware/Trojan:Win32/Qshell"
            },
            {
              "id": "Trojan:Win32/Mydoom",
              "display_name": "Trojan:Win32/Mydoom",
              "target": "/malware/Trojan:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1197",
              "name": "BITS Jobs",
              "display_name": "T1197 - BITS Jobs"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "695557ee134b978b00883c29",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8897,
            "domain": 2102,
            "hostname": 2867,
            "FileHash-SHA256": 3886,
            "FileHash-MD5": 619,
            "FileHash-SHA1": 555,
            "CVE": 3,
            "email": 5,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 18942,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6919473b9e0624394e9b68e9",
          "name": "Backdoor:Linux/DemonBot Affecting Unsecured servers",
          "description": "A closer look at a hacker group found in  Mirai Bot Network. Catgirls is still active , has running web server , is  only viewable to group according to remarks regarding \u2018catgirls\u2019 domains , sub domains , hosts.\n\n Multiple hosts , name servers and links. .Backdoor:Linux/DemonBot Malicious attacks affecting unsecured servers  (personal , business) networks, DDOS attacks , Mitre. Worm, Ransomware. \n\nHacker group has seemingly caused a fair ammunition of damage to small businesses and / or individuals/civil society.. Seen in attacks against handful of targets are in this Mirai Botnet. Of course we know how very large the  Mirai Botnet is.",
          "modified": "2025-12-16T03:02:09.743000",
          "created": "2025-11-16T03:38:35.430000",
          "tags": [
            "server",
            "algorithm",
            "x509v3 subject",
            "registrar abuse",
            "v3 serial",
            "spaceship",
            "community",
            "related pulses",
            "cidr",
            "mirai botnet",
            "hacker",
            "mirai att",
            "ck id",
            "group",
            "active",
            "generic pong",
            "reporting arch",
            "msie",
            "windows nt",
            "resolverror",
            "backdoor",
            "malware",
            "strings",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "evasion att",
            "t1480 execution",
            "ipv4",
            "iocs",
            "drop",
            "review iocs",
            "found",
            "ascii text",
            "pattern match",
            "mitre att",
            "beginstring",
            "null",
            "refresh",
            "span",
            "hybrid",
            "click",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "moved",
            "passive dns",
            "urls",
            "record value",
            "unknown aaaa",
            "gmt content",
            "title",
            "cookie",
            "signing defense",
            "t1553 technique",
            "subvert trust",
            "controls learn",
            "disable",
            "modify tools",
            "defense evasion",
            "t1562 technique",
            "rdap",
            "domain database",
            "dap domain",
            "datab",
            "database",
            "array",
            "content",
            "ascii",
            "form",
            "initial access",
            "execution",
            "present aug",
            "present jul",
            "present nov",
            "present oct",
            "ip address",
            "command decode",
            "suricata ipv4",
            "localappdata",
            "windir",
            "openurl c",
            "programfiles",
            "edge",
            "cloudflare",
            "ssl certificate",
            "size",
            "starfield",
            "accept",
            "path",
            "general",
            "local",
            "hostname add",
            "pulse pulses",
            "read c",
            "port",
            "destination",
            "rgba",
            "unicode text",
            "medium",
            "unknown",
            "code",
            "write",
            "pecompact",
            "packer",
            "delphi",
            "win32",
            "persistence",
            "crash",
            "next",
            "china unknown",
            "chrome",
            "internal server",
            "next associated",
            "ipv4 add",
            "trojandropper",
            "date",
            "domain",
            "search",
            "domain add",
            "certificate",
            "next http",
            "scans show",
            "found title",
            "head body",
            "hostname",
            "files",
            "files ip",
            "address",
            "location united",
            "asn asnone",
            "present feb",
            "present jun",
            "unknown ns",
            "internet",
            "emails",
            "present sep",
            "show",
            "memcommit",
            "gapd5d",
            "key0",
            "packing t1045",
            "filehash",
            "sha1 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "medium risk",
            "mirai",
            "json",
            "total",
            "delete",
            "win64",
            "url http",
            "http",
            "related nids",
            "files location",
            "flag united",
            "gmt cache",
            "pulse submit",
            "url analysis",
            "verdict",
            "win32dh",
            "reverse dns",
            "america flag",
            "worm",
            "warehouse mgmt",
            "built",
            "retailexperts",
            "read",
            "top source",
            "top destination",
            "aaaa",
            "ransom",
            "trojan",
            "entries",
            "singapore",
            "singapore asn",
            "as16509",
            "present mar",
            "creation date",
            "contacted",
            "hostile",
            "targeting",
            "whitelisted",
            "high",
            "systemroot",
            "as15169",
            "copy",
            "global",
            "dynamicloader",
            "directui",
            "yara rule",
            "element",
            "classinfobase",
            "ccbase",
            "hwndhost",
            "windows"
          ],
          "references": [
            "http://catgirls.foundation/main \u2022 https://spaceship.com/",
            "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f",
            "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2",
            "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2"
          ],
          "public": 1,
          "adversary": "Mirai",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Linux/DemonBot.Aa!MTB",
              "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
              "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
            },
            {
              "id": "Mirai (ELF)",
              "display_name": "Mirai (ELF)",
              "target": null
            },
            {
              "id": "Backdoor:Linux/Mirai",
              "display_name": "Backdoor:Linux/Mirai",
              "target": "/malware/Backdoor:Linux/Mirai"
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "PSW.Sinowal.X",
              "display_name": "PSW.Sinowal.X",
              "target": null
            },
            {
              "id": "mirai",
              "display_name": "mirai",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Win.Virus.PolyRansom-5704625-0",
              "display_name": "Win.Virus.PolyRansom-5704625-0",
              "target": null
            },
            {
              "id": "Worm:Win32/Locksky.gen!A",
              "display_name": "Worm:Win32/Locksky.gen!A",
              "target": "/malware/Worm:Win32/Locksky.gen!A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1991,
            "domain": 428,
            "hostname": 882,
            "FileHash-SHA256": 2213,
            "FileHash-MD5": 675,
            "FileHash-SHA1": 530,
            "email": 7,
            "CIDR": 1,
            "CVE": 1,
            "SSLCertFingerprint": 23
          },
          "indicator_count": 6751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "125 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "http://catgirls.foundation/main \u2022 https://spaceship.com/",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "http://watchhers.net/index.php",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.vgt.pl/favicon.ico",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "remotewd.com device local",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Mirai"
          ],
          "malware_families": [
            "Trojan:win32/mydoom",
            "Mirai (elf)",
            "Other malware",
            "Trojanspy:win32/nivdort",
            "Mirai",
            "Trojan:win32/qshell",
            "Worm:win32/locksky.gen!a",
            "Backdoor:linux/mirai",
            "Win.virus.polyransom-5704625-0",
            "Worm:win32/autorun",
            "Jaik",
            "Psw.sinowal.x",
            "Tofsee",
            "Backdoor:linux/demonbot.aa!mtb"
          ],
          "industries": [],
          "unique_indicators": 25060
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/zoewu0907.com",
    "whois": "http://whois.domaintools.com/zoewu0907.com",
    "domain": "zoewu0907.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "69b49ad5dd40a24d83cd6a72",
      "name": "Chris P. Ahmann \u2022 PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-03-13T23:16:37.716000",
      "created": "2026-03-13T23:16:37.716000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69631fbd16e306ee2b76c4da",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "37 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b496396ca4987e95ad37d1",
      "name": "Chris Buzz by QVashni (wow)",
      "description": "",
      "modified": "2026-03-13T22:56:57.314000",
      "created": "2026-03-13T22:56:57.314000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69482caa00d327da8f0a87bc",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "38 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b49587dd104e342dda1628",
      "name": "C Ahman Attorney Clone by Top Tier, Q.Vashti",
      "description": "",
      "modified": "2026-03-13T22:53:59.112000",
      "created": "2026-03-13T22:53:59.112000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "38 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "691f4d4ef0a2a570b8b21cd2",
      "name": "Chris P. Ahmann Colorado State Criminal Defense Attorney",
      "description": "Chris P. Ahmann Colorado State Criminal Defense attorney hired by quasi government Workers Compensation to completely destroy Tsara Brashears literally to death. None of her spinal cord injuries , and other assault injuries discussed or compensated for in rushed settlement case. Her awful racist attorney refused to represent plaintiffs in hearing. Never met with in person  for no good reason. Tsara represented herself.  Less that 24 hour notice. No briefings, no awareness or mention that Ahmann was representing Jeffrey Scott Reimer for assault\n case. Brashears required 24 hour care by end of life. Received 0 workers compsarion payments. But if this doesn\u2019t prove Reimer\u2019s guilt what does? Continued harassment of associated. \n\nNotice the outages? You\u2019ve cost BILLIONS? Stop threatening everyone.",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-11-20T17:18:06.929000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69482caa00d327da8f0a87bc",
      "name": "Chris P.\u2019 Buzz\u2019 Ahmann Colorado State Criminal Defense Attorney (22.20.2025)",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-21T17:21:46.434000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "695557ee134b978b00883c29",
      "name": "Chris P. Ahmann \u2022 Stay out of PRIVATE PROPERTY HITMAN!  Colorado State",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2025-12-31T17:05:50.134000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "691f4d4ef0a2a570b8b21cd2",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69631fbd16e306ee2b76c4da",
      "name": "Chris P. Ahmann \u2022 STAY Away!f PRIVATE PROPERTY Colorado State Fixer!",
      "description": "",
      "modified": "2026-01-20T17:02:02.650000",
      "created": "2026-01-11T03:57:49.242000",
      "tags": [
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "sct1",
        "active",
        "dynamicloader",
        "medium",
        "write c",
        "search",
        "show",
        "high",
        "program gateway",
        "http traffic",
        "http",
        "write",
        "malware",
        "nivdort",
        "serving ip",
        "address",
        "status code",
        "kb body",
        "sha256",
        "gw5hjz7t975",
        "url https",
        "url http",
        "indicator role",
        "pulses url",
        "hostname",
        "poland unknown",
        "present sep",
        "present jul",
        "present may",
        "present apr",
        "present dec",
        "present jan",
        "moved",
        "passive dns",
        "ip address",
        "title",
        "location poland",
        "asn as29522",
        "gmt content",
        "accept encoding",
        "ipv4 add",
        "urls",
        "files",
        "reverse dns",
        "united",
        "record value",
        "aaaa",
        "mtb oct",
        "found",
        "error",
        "read c",
        "memcommit",
        "module load",
        "next",
        "showing",
        "trojan",
        "execution",
        "unknown",
        "entries",
        "ms windows",
        "intel",
        "as15169",
        "codeoverlap",
        "yara detections",
        "delphi",
        "worm",
        "win32",
        "win64",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "script urls",
        "treece alfrey",
        "meta",
        "germany unknown",
        "for privacy",
        "title added",
        "active related",
        "pulses",
        "asnone",
        "named pipe",
        "type indicator",
        "role title",
        "added active",
        "filehashsha256",
        "ally",
        "melika",
        "information",
        "law christopher",
        "https",
        "fake pinterest",
        "tsara",
        "traceback man",
        "expiro",
        "capture",
        "domain",
        "types of",
        "germany",
        "poland",
        "netherlands",
        "cve cve20178977",
        "boobs130432 nov",
        "learn more",
        "filehashmd5",
        "utmsourceawin",
        "pe32",
        "head microsoft",
        "delete",
        "main",
        "backdoor",
        "next associated",
        "gmt connection",
        "control",
        "content type",
        "twitter",
        "certificate",
        "redirect date",
        "cache",
        "unknown ns",
        "hostname add",
        "ipv4",
        "pulse pulses",
        "location united",
        "america flag",
        "america asn",
        "windows",
        "total",
        "ids detections",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "win32mydoom nov",
        "domain add",
        "yara rule",
        "ee fc",
        "ff d5",
        "f0 ff",
        "eb e1",
        "ff ff",
        "c1 e8",
        "c1 c0",
        "eb e8",
        "mpress",
        "cache control",
        "x cache",
        "date",
        "name servers",
        "arial",
        "present aug",
        "present jun",
        "may god",
        "hall render",
        "palantir doing",
        "jeffrey scott",
        "jeffrey reimer",
        "brian sabey",
        "butt pirates",
        "scott reimer",
        "colorado",
        "quasi government",
        "workers compensation",
        "eva lisa",
        "eva reimer",
        "sammie",
        "montano mark",
        "death threats",
        "tulach",
        "hired hit men",
        "gay man",
        "gay porn",
        "concentra",
        "corruption",
        "palantir",
        "foundry",
        "grifter",
        "warning",
        "illegal",
        "apple",
        "contacted",
        "ransom",
        "dead",
        "denver"
      ],
      "references": [
        "https://tamlegal.com/attorneys/christopher-p-ahmann/#breadcrumb \u2022 https://www.milehighmedia.com/en/movies",
        "https://www.milehighmedia.com/legal/2257 \u2022 https://www.milehighmedia",
        "www.milehighmedia.com  \u2022 https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512",
        "https://www.milehighmedia.com/en/login/index/aHR0cHMlM0ElMkYlMkZtZW1iZXJzLm1pbGVoaWdobWVkaWEuY29tJTJGZW4lMkZ2aWRlb3MlMkZzd2VldGhlYXJ0dmlkZW8lM0ZhbHVwJTNEQURqeF9ITjhfd1oweU96UnpsU3NNNUZLaVVxSzBXNEN0X3NmTFpKTGVJc3M2b0RVUzkwVmp6VllNVko5eFpmdENYcFNKd3IzOTNaMG1mOEpXeVhVeVZpLTJZYVRsaGd3M25DSDRpYnRwZ25BRC1zUFhDQVUycjZJOXo2WWtRMzNVWVFhMFZyWC1YckxvcnRkVjJZdEgxSDYxZ1lhMTFNS3RZSkEzY3FlSXhFQzhtSlAzSk1tbloySURMQXlMZndPcHozSFFiTzF4T0FseXJIQ0xYem1ldFElMkE=\t \thttp://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNz",
        "http://www.milehighmedia.com/legal\t \u2022  https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://www.milehighmedia.com/de/MileHighMedia/scene/129689?utm_source=271174&utm_medium=affiliate&utm_campaign=",
        "http://www.milehighmedia.com/?ats=eyJhIjoyOTYzMTgsImMiOjU3OTYzNzc1LCJuIjo3NiwicyI6NT...",
        "ttps://www.milehighmedia.com/scene/4404473/creampie-adventures-scene-2-sneaky-melanie",
        "https://www.milehighmedia.com/join \u2022 https://www.milehighmedia.com/models \u2022 https://www.milehighmedia.com/movies",
        "https://www.milehighmedia.com/model/59136/avi-love \u2022https://www.milehighmedia.com/model/60418/Justin-Hunt \u2022",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.milehighmedia.com/en/movies \u2022  https://www.milehighmedia.com/join",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "pornhub-e.com \u2022 www.pornhub.com \u2022",
        "https://www.sweetheartvideo.com/tsara-brashears/ \u2022 www.sweetheartvideo.com",
        "https://www.sweetheartvideo.com/en/?s=1?s=1&utm_source=272160&utm_medium=affiliate&utm_campaign=lovelezzies",
        "https://www.sweetheartvideo.com/en/dvd/Lesbian-Massage/49895",
        "https://www.sweetheartvideo.com/en/dvds \u2022 https://www.sweetheartvideo.com/en/login",
        "https://www.sweetheartvideo.com/en/model/Mona-Wales/49601 \u2022 https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432 No Expiration\t0\t  URL https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432 \u2022 https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/model/63710/brandi-love",
        "https://www.sweetheartvideo.com/scenes?models=63710",
        "https://www.sweetheartvideo.com/it/model/Kristen-Scott/50432",
        "https://www.sweetheartvideo.com/en/scene/Truth-Dare--Boobs/130432",
        "https://www.milehighmedia.com/en/photo/milehighmedia/The-Mother-I-Cant-Resist/52380",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot  \u2022",
        "https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "https://www.vgt.pl/favicon.ico",
        "https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.ttf  \u2022  https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Medium.ttf",
        "https://www.vgt.pl/font/roboto/Roboto-Light.ttf  \u2022",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/font/roboto/Roboto-Medium.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Thin.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.js.179.252.2",
        "https://www.vgt.pl/font/roboto/Roboto-Thin.ttf \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/font/roboto/Roboto-Regular.eot \u2022 https://www.vgt.pl/94.152.156.22/logo.png \u2022 https://www.vgt.pl/css/",
        "vgt.pl \u2022 www.hak.vgt.pl \u2022 www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 aristocrat.vgt.pl",
        "https://www.vgt.pl/ phishing \u2022 https://vgt.pl/ \u2022www.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "http://www.pornokind.vgt.pl \u2022 https://dbkuewww.m.vgt.pl \u2022 https://lokalnyhost.vgt.pl \u2022 www.xn--twj-hna.pedofil.vgt.pl",
        "http://www.hak.vgt.pl \u2022 http://pornokind.vgt.pl \u2022 http://sip.vgt.pl \u2022 http://smtp-qa.vgt.pl \u2022  http://vgt.pl/*.",
        "https://pornokind.vgt.pl \u2022 https://sip.vgt.pl \u2022 https://smtp-qa.vgt.pl \u2022 https://www.vgt.pl/94.152.156.22/logo.png",
        "www.localhost.vgt.pl \u2022 www.certyfikat.vgt.pl \u2022 https://www.vgt.pl/94.152.152.233/images/logo.png",
        "https://www.vgt.pl/css/ \u2022 https://www.vgt.pl/favicon.ico \u2022 https://www.vgt.pl/font/fa/fontawesome-webfont.eot",
        "https://www.vgt.pl/font/roboto/Roboto-Bold.eot \u2022 https://www.vgt.pl/font/roboto/Roboto-Bold.ttf \u2022 https://www.vgt.pl/font/roboto/Roboto-Light.eot",
        "https://www.vgt.pl/static/js/bootstrap-typeahead.jstic/js/bootstrap-typeahead.js",
        "https://www.vgt.pl/style/style.css \u2022 https://www.vgt.pl/static/js/bootstrap-typeahead.js",
        "IP Address 94.152.58.192 Location  Poland ASN AS29522 h88 s.a. Nameservers ns1.kei.pl. ,  ns2.kei.pl.",
        "www.happylifehappywife.com \u2022  http://www.happylifehappywife.com/2010/02/'>",
        "http://www.happylifehappywife.com/2010/04/'> \u2022 http://www.happylifehappywife.com/2010/05/'>",
        "http://www.happylifehappywife.com/2010/07/'> \u2022 http://www.happylifehappywife.com/2010/09/'>",
        "http://www.happylifehappywife.com/2011/06/'> \u2022 http://www.happylifehappywife.com/2011/08/'",
        "http://www.happylifehappywife.com/2011/08/'> \u2022 http://www.happylifehappywife.com/2012/07/'>",
        "http://www.happylifehappywife.com/2013/03/'> \u2022 http://www.happylifehappywife.com/index.php",
        "http://www.happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg",
        "https://amp.mypornvid.fun/videos/8/AhxS-ej1myg/gf-18-com/\ud83c\udf81-i39m-your-present-\ud83c\udf81-girlfriend-surprises-you-for-christmas-reunion-soft-kisses-amp-cuddles",
        "8-25-220-162-static.reverse.queryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t5\t  domain\tqueryfoundry.net\t\t\tNov 1, 2025, 9:34:14 AM\t\t8\t  URL\thttp://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://watchhers.net/index.php",
        "remotewd.com device local",
        "nr-data.net \u2022 applemusic-spotlight.myunidays.com \u2022  init.ess.apple.com \u2022 tv.apple.com",
        "https://browntubeporn.com/tsara-brashearsAccept-Language",
        "https://cg864.myhotzpic.com phishing \u2022 http://dashboard.myhotzpic.com/",
        "https://myhotzpic.com/tsara-brashears-hardcore-lesbian-sex/anime-studio.org*thumbs-fa...",
        "https://mypornvid.com/videos/27/x510fb2/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/caillou-finger",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead \u2022 http://siteinlink.d1.cnbd.net/site/maps.google.com.lb/",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-assaulted-by-jeffrey-reimer",
        "http://siteinlink.d1.cnbd.net/search/tsara-brashears-dead   \u2022 https://videolal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://pixelrz.com/lists/keywords/tsara-brashears-dead/360 \u2022 http://pixelrz.com/lists/keywords/tsara-brashears-dead/360] No Expiration\t4\t  Domain tsara-brashears-deadspin-twitter-suspended-account-help.ht",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://twitter.com/PORNO_SEXYBABES \u2022 girlsdoporn.com",
        "Treece Alfrey Musat P.C. Attorneys at Law Christopher P. Ahmann | https://TamLegal.com",
        "https://urlscan.io/screenshots/e931bb02-80dc-46db-92f0-43d5afa258be.png"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Jaik",
          "display_name": "Jaik",
          "target": null
        },
        {
          "id": "Trojan:Win32/Qshell",
          "display_name": "Trojan:Win32/Qshell",
          "target": "/malware/Trojan:Win32/Qshell"
        },
        {
          "id": "Trojan:Win32/Mydoom",
          "display_name": "Trojan:Win32/Mydoom",
          "target": "/malware/Trojan:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1197",
          "name": "BITS Jobs",
          "display_name": "T1197 - BITS Jobs"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "695557ee134b978b00883c29",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8897,
        "domain": 2102,
        "hostname": 2867,
        "FileHash-SHA256": 3886,
        "FileHash-MD5": 619,
        "FileHash-SHA1": 555,
        "CVE": 3,
        "email": 5,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 18942,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6919473b9e0624394e9b68e9",
      "name": "Backdoor:Linux/DemonBot Affecting Unsecured servers",
      "description": "A closer look at a hacker group found in  Mirai Bot Network. Catgirls is still active , has running web server , is  only viewable to group according to remarks regarding \u2018catgirls\u2019 domains , sub domains , hosts.\n\n Multiple hosts , name servers and links. .Backdoor:Linux/DemonBot Malicious attacks affecting unsecured servers  (personal , business) networks, DDOS attacks , Mitre. Worm, Ransomware. \n\nHacker group has seemingly caused a fair ammunition of damage to small businesses and / or individuals/civil society.. Seen in attacks against handful of targets are in this Mirai Botnet. Of course we know how very large the  Mirai Botnet is.",
      "modified": "2025-12-16T03:02:09.743000",
      "created": "2025-11-16T03:38:35.430000",
      "tags": [
        "server",
        "algorithm",
        "x509v3 subject",
        "registrar abuse",
        "v3 serial",
        "spaceship",
        "community",
        "related pulses",
        "cidr",
        "mirai botnet",
        "hacker",
        "mirai att",
        "ck id",
        "group",
        "active",
        "generic pong",
        "reporting arch",
        "msie",
        "windows nt",
        "resolverror",
        "backdoor",
        "malware",
        "strings",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "evasion att",
        "t1480 execution",
        "ipv4",
        "iocs",
        "drop",
        "review iocs",
        "found",
        "ascii text",
        "pattern match",
        "mitre att",
        "beginstring",
        "null",
        "refresh",
        "span",
        "hybrid",
        "click",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "united",
        "moved",
        "passive dns",
        "urls",
        "record value",
        "unknown aaaa",
        "gmt content",
        "title",
        "cookie",
        "signing defense",
        "t1553 technique",
        "subvert trust",
        "controls learn",
        "disable",
        "modify tools",
        "defense evasion",
        "t1562 technique",
        "rdap",
        "domain database",
        "dap domain",
        "datab",
        "database",
        "array",
        "content",
        "ascii",
        "form",
        "initial access",
        "execution",
        "present aug",
        "present jul",
        "present nov",
        "present oct",
        "ip address",
        "command decode",
        "suricata ipv4",
        "localappdata",
        "windir",
        "openurl c",
        "programfiles",
        "edge",
        "cloudflare",
        "ssl certificate",
        "size",
        "starfield",
        "accept",
        "path",
        "general",
        "local",
        "hostname add",
        "pulse pulses",
        "read c",
        "port",
        "destination",
        "rgba",
        "unicode text",
        "medium",
        "unknown",
        "code",
        "write",
        "pecompact",
        "packer",
        "delphi",
        "win32",
        "persistence",
        "crash",
        "next",
        "china unknown",
        "chrome",
        "internal server",
        "next associated",
        "ipv4 add",
        "trojandropper",
        "date",
        "domain",
        "search",
        "domain add",
        "certificate",
        "next http",
        "scans show",
        "found title",
        "head body",
        "hostname",
        "files",
        "files ip",
        "address",
        "location united",
        "asn asnone",
        "present feb",
        "present jun",
        "unknown ns",
        "internet",
        "emails",
        "present sep",
        "show",
        "memcommit",
        "gapd5d",
        "key0",
        "packing t1045",
        "filehash",
        "sha1 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "medium risk",
        "mirai",
        "json",
        "total",
        "delete",
        "win64",
        "url http",
        "http",
        "related nids",
        "files location",
        "flag united",
        "gmt cache",
        "pulse submit",
        "url analysis",
        "verdict",
        "win32dh",
        "reverse dns",
        "america flag",
        "worm",
        "warehouse mgmt",
        "built",
        "retailexperts",
        "read",
        "top source",
        "top destination",
        "aaaa",
        "ransom",
        "trojan",
        "entries",
        "singapore",
        "singapore asn",
        "as16509",
        "present mar",
        "creation date",
        "contacted",
        "hostile",
        "targeting",
        "whitelisted",
        "high",
        "systemroot",
        "as15169",
        "copy",
        "global",
        "dynamicloader",
        "directui",
        "yara rule",
        "element",
        "classinfobase",
        "ccbase",
        "hwndhost",
        "windows"
      ],
      "references": [
        "http://catgirls.foundation/main \u2022 https://spaceship.com/",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/68e72a3b96eaf61daf0eb13f",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2",
        "https://hybrid-analysis.com/sample/afe4977aae088e0c74e9acd2137d9ac11f171780399010cc1197adfab926bbc2/691924001d6dc4fa2d04d0b2"
      ],
      "public": 1,
      "adversary": "Mirai",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Linux/DemonBot.Aa!MTB",
          "display_name": "Backdoor:Linux/DemonBot.Aa!MTB",
          "target": "/malware/Backdoor:Linux/DemonBot.Aa!MTB"
        },
        {
          "id": "Mirai (ELF)",
          "display_name": "Mirai (ELF)",
          "target": null
        },
        {
          "id": "Backdoor:Linux/Mirai",
          "display_name": "Backdoor:Linux/Mirai",
          "target": "/malware/Backdoor:Linux/Mirai"
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "PSW.Sinowal.X",
          "display_name": "PSW.Sinowal.X",
          "target": null
        },
        {
          "id": "mirai",
          "display_name": "mirai",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Win.Virus.PolyRansom-5704625-0",
          "display_name": "Win.Virus.PolyRansom-5704625-0",
          "target": null
        },
        {
          "id": "Worm:Win32/Locksky.gen!A",
          "display_name": "Worm:Win32/Locksky.gen!A",
          "target": "/malware/Worm:Win32/Locksky.gen!A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1991,
        "domain": 428,
        "hostname": 882,
        "FileHash-SHA256": 2213,
        "FileHash-MD5": 675,
        "FileHash-SHA1": 530,
        "email": 7,
        "CIDR": 1,
        "CVE": 1,
        "SSLCertFingerprint": 23
      },
      "indicator_count": 6751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "125 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://zoewu0907.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://zoewu0907.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776726640.1338773
}