{
  "type": "Domain",
  "indicator": "impactserving.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/impactserving.com",
    "alexa": "http://www.alexa.com/siteinfo/impactserving.com",
    "indicator": "impactserving.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #8669",
        "name": "Akamai Popular Domain"
      }
    ],
    "base_indicator": {
      "id": 3351110128,
      "indicator": "impactserving.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 13,
      "pulses": [
        {
          "id": "695089cbedad5c86f39b1363",
          "name": "Tracking Domains 03.03.26 (Updated Test)",
          "description": "Privacy Badger - Update on 01.09.26\nTracking domains on a hybrid (mobile laptop) clone of an AHS/Covenant Health, UAlberta (University of Alberta), and Government of Alberta Laptop.\nHealthcare: No Cybersecurity, EDU: No Cybersecurity / Remote only, GoA = Informed & don't quite know what to do or to whom this should be brought up with.",
          "modified": "2026-04-05T06:35:43.679000",
          "created": "2025-12-28T01:37:15.993000",
          "tags": [
            "privacy badger",
            "sites general",
            "settings widget",
            "domains manage",
            "data privacy",
            "badger",
            "hide"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
            "https://yaraify.abuse.ch/scan/results/32bfc760-1757-11f1-b47f-42010aa4000b",
            "https://polyswarm.network/scan/results/file/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
            "https://app.threat.zone/submission/c8b0b1e4-0c9b-4210-b5ce-1dc2303445df/overview",
            "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs",
            "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/summary",
            "https://www.virustotal.com/graph/embed/g6d4bce6162064ac09cd20411c1947e69d7d5a1d475f0447da023ac933d338fce?theme=dark",
            "https://viz.greynoise.io/ip/analysis/6356f330-63a7-4ce3-91fa-7ab355a1dc1a"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 50404,
            "hostname": 10879,
            "URL": 715,
            "FileHash-MD5": 1
          },
          "indicator_count": 61999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "14 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64ed117e2308a042e50e1e9e",
          "name": "Investigation of Distribution Vectors and Threat Network Infrastructure",
          "description": "Targets: Individual(s), University of Alberta Infrastructure, Covenant Health (Alberta Health Services), TELUS Communications (Network & Mobile infrastructure), Government of Alberta, Government of Canada. International entities spanning primarily government, healthcare, and educational institutions.",
          "modified": "2025-11-23T23:20:07.571000",
          "created": "2023-08-28T21:28:30.294000",
          "tags": [
            "Domains",
            "ip addresses",
            "URLs",
            "Files",
            "Alberta Health Services",
            "BEC",
            "Education",
            "University of Alberta",
            "Government of Alberta",
            "Covenant Health Alberta",
            "Telus Communications",
            "Canadian Universities",
            "Malicious Certificates",
            "Digital Identity Theft / Credential Theft"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
            "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
            "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
            "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
            "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
            "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
            "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
            "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary",
            "https://www.virustotal.com/gui/collection/3bf1c0922ee6f4d041effbf9f72a21a1e9f4b38d0593cfbeaca24851cf712eac",
            "https://www.virustotal.com/gui/collection/2cdadbf6aa2ec4f9815c038b0e9375b1475ac7e049fd123861d6e925e7802c6a",
            "https://www.virustotal.com/gui/collection/ba238f4d585b87abb85c126f927090cb866facfa9e4e2e0db8e307aff553397d",
            "https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5/summary",
            "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2",
            "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327",
            "https://www.virustotal.com/gui/collection/fd8ebe64d72b2ad9e90773791522c3ec5863868dc3b9c58a929c6b4e01bb3042",
            "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
            "https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5",
            "https://www.virustotal.com/gui/collection/6434f0cf09638991baf3be289834696b46e11c4c6cbe1e7b9548f9ac27372b53",
            "https://www.virustotal.com/gui/collection/bc7e252dcc07855314e153efe890d70e7a7e9b8a743e171eac31e5951260c1b7",
            "https://www.virustotal.com/gui/collection/dbf356b0a281fa94308e2e24738d839491491bfb2defa4e6c42662646e52c8f8",
            "https://www.virustotal.com/gui/collection/f60b8061133367a1047262a1e90d54cd72de4d59885c267906c6eeb557a35500",
            "https://www.virustotal.com/gui/collection/da124f42943c08f1cafdc1c42635457b0c69ccce41b4031263af3235717996a2/summary",
            "https://www.virustotal.com/gui/collection/daab0521ae533cbdfeec047e51a9499aedfd27c8cc05c644950126c1947131f9",
            "https://www.virustotal.com/gui/collection/12100cb4982365cfe5122fcedda2c084d60cebe09314846cae980c36fc90fc8c/iocs",
            "https://www.virustotal.com/graph/embed/g9219350397134ff3a645319a88b67833077c9cf0f50d4979aa0239a3d0b6ecea?theme=dark",
            "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602",
            "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph",
            "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs",
            "https://www.virustotal.com/gui/collection/da35693aa528a682ca91aee332c8155d99ac8e4a13077cc73b2a8921c8fea36b",
            "https://www.virustotal.com/gui/collection/1497c56a475d73236c67292964eabd7f8961f88c57fa5a2e3f30720dc29a51e7",
            "https://www.virustotal.com/gui/collection/8228434e85241bd42ae063de8cf2ee2afb86f0848675ed11e3f33b967e8c3c7c",
            "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188",
            "https://www.virustotal.com/gui/collection/6a4e699473879d39e15ed7cd130f2ee9543f842b92c9ad8b78e310968f4b086f",
            "https://www.virustotal.com/graph/embed/g3dae42eb79cc447182e3a3dd746e462f0903d71c784d4f5cacf970954deea221?theme=dark",
            "https://www.virustotal.com/graph/embed/gc0d82762363b4aa88991027c391afdbfe9585395bd8d4273bbe09907fbfaf532?theme=light",
            "https://www.virustotal.com/graph/embed/g78ea5ea9b68b4a4bbcd2bc078e23b321985e72d90da146c19d8d80ede366c1fa?theme=dark",
            "https://www.virustotal.com/gui/collection/8f89eb9579ca53d15294ec27a4c1e763998ce57d3644ea746621d9fe0cb57e55/iocs",
            "https://www.virustotal.com/graph/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076",
            "https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f/iocs",
            "https://www.virustotal.com/graph/g38632f8b939b443ab3b69f6a3171d02ffd2696a0f3714325a84b9a5f227a7d1c",
            "https://www.virustotal.com/gui/collection/4b166c2c1752d85215da951b15a065688bfe24ea92c65228a45ded6f2d94685b/iocs",
            "https://www.virustotal.com/graph/embed/g798b5e01446c4711ba22802009d71f5ba78553df16794088a907ae7456e2a017?theme=dark",
            "https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f",
            "https://www.virustotal.com/gui/collection/a6a81c8412b19ac6357a7c6e978c31a38d52a75fbb3b2e44f0f1a2bf0deb8a58/iocs",
            "https://www.virustotal.com/graph/embed/g699a7b9bfb324855859555181d01666c372310cf233441e08a095459b3394dea?theme=dark",
            "https://www.virustotal.com/graph/embed/g6a67af8ffa22446da35d6989d7d0bc47efcd295eb893471e9b4912080c1dddef?theme=dark",
            "https://www.virustotal.com/graph/embed/g23481631a7c745c6ba19f72ce9f853643d17706c08ab44eb8851eb5c56c0f073?theme=dark",
            "https://www.virustotal.com/graph/embed/g3b316b58b8c54064b322b2e186d62950d7632add2f3f408f8d8a1706563fd3c0?theme=dark",
            "https://www.virustotal.com/graph/embed/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076?theme=dark",
            "https://www.virustotal.com/graph/g40f442f2b5d64cba818cac88855ba4ce274d109ce4ef4fb496f1af4efb993886",
            "https://www.virustotal.com/gui/collection/0c9360cb9f8601bd6cdf912eb414d67902487f0c4eec96e952377e300ff4e983/iocs",
            "https://www.virustotal.com/gui/collection/a1866f4c7dbc79920d0c7e914a3bace0d3dc424a2aac06bf30bf724c6c8b0375/iocs",
            "https://www.virustotal.com/gui/collection/82dc29932b9184d02b037289fd4605c158e96a57f376b08a8b2b94e43d0ae18b/iocs",
            "https://viz.greynoise.io/ip/analysis/ae06b3b5-c746-4b44-b2ac-19bb3aea14a1 [11.23.25 - 1000ipv4]"
          ],
          "public": 1,
          "adversary": "Unknown APT Group(s) / Threat Actor (s)",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Philippines",
            "Panama",
            "Netherlands",
            "Anguilla",
            "Saint Vincent and the Grenadines",
            "Aruba",
            "Mexico",
            "Guatemala",
            "Costa Rica",
            "Tanzania, United Republic of"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 111,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 236,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 1421,
            "URL": 9580,
            "CIDR": 30,
            "domain": 10205,
            "email": 12,
            "hostname": 517612,
            "IPv4": 11,
            "CVE": 62
          },
          "indicator_count": 539308,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "691b61e16cea7624a6606a69",
          "name": "For Later",
          "description": "***",
          "modified": "2025-11-17T18:46:19.094000",
          "created": "2025-11-17T17:56:49.875000",
          "tags": [
            "wormhole",
            "want",
            "sign",
            "submit send",
            "copy",
            "share show",
            "report delete",
            "faq roadmap",
            "security legal",
            "twitter discord",
            "protected"
          ],
          "references": [
            "https://wormhole.app/Pp5DdP#3EpzsqLhw5lJdQ0Xe_mRQA",
            "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 72127,
            "hostname": 16700,
            "URL": 50
          },
          "indicator_count": 88877,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "152 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "688ef0516013ca78448bf4e5",
          "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary",
          "description": "Foundry ?  Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber &  Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose.  Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?",
          "modified": "2025-09-02T04:01:31.218000",
          "created": "2025-08-03T05:14:57.402000",
          "tags": [
            "united",
            "moved",
            "entries",
            "passive dns",
            "detected m1",
            "next associated",
            "mtb apr",
            "mtb aug",
            "server",
            "gmt content",
            "trojandropper",
            "trojan",
            "body",
            "lokibot request",
            "c2 commands",
            "detected m2",
            "otx telemetry",
            "historical otx",
            "twitter running",
            "open ports",
            "cves",
            "time",
            "dynamicloader",
            "port",
            "search",
            "show",
            "destination",
            "alerts",
            "copy",
            "dynamic",
            "medium",
            "write",
            "creation date",
            "hostmaster",
            "urls",
            "domain",
            "showing",
            "hostname add",
            "pulse pulses",
            "date",
            "flag",
            "falcon sandbox",
            "name server",
            "markmonitor",
            "analysis",
            "mitre att",
            "anonymous",
            "upgrade",
            "hybrid",
            "contact",
            "usa windows",
            "december",
            "input threat",
            "level analysis",
            "summary",
            "february",
            "hwp support",
            "january",
            "october",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "calls",
            "command",
            "javascript",
            "object model",
            "model",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "temp",
            "getprocaddress",
            "script",
            "license",
            "runtime process",
            "copy md5",
            "facebook",
            "roboto",
            "error",
            "win64",
            "path",
            "blink",
            "meta",
            "factory",
            "general",
            "comspec",
            "click",
            "strings",
            "damage",
            "mini",
            "stop",
            "core",
            "expl",
            "win32",
            "gmt server",
            "ecacc saa83dd",
            "ipv4 add",
            "twitter",
            "cobalt strike",
            "mozilla"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 263,
            "FileHash-SHA1": 256,
            "FileHash-SHA256": 837,
            "hostname": 4415,
            "URL": 1918,
            "domain": 1884,
            "email": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9577,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "229 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67f5555b6ce863d998e83e26",
          "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net",
          "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-<UUID>.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.",
          "modified": "2025-05-11T19:03:59.885000",
          "created": "2025-04-08T16:56:59.641000",
          "tags": [
            "generated from",
            "do not",
            "edit uri",
            "urls",
            "edit",
            "rewriteengine",
            "rewritecond",
            "rewriterule",
            "r301",
            "xml2encalias",
            "beralloct",
            "berbvarrayadd",
            "berbvarrayfree",
            "berbvdup",
            "berbvecadd",
            "berbvecfree",
            "berbvfree",
            "berdump",
            "berdup",
            "berdupbv",
            "laerrordomain",
            "laerrornoncekey",
            "lamechanismtree",
            "lacontext",
            "ladomainstate",
            "laenvironment",
            "lanotification",
            "laprivatekey",
            "lapublickey",
            "laright",
            "apple swift",
            "o librarylevel",
            "combine import",
            "foundation",
            "swift import",
            "mcpeerid",
            "mcsession",
            "property",
            "copyright",
            "protocol",
            "class",
            "bonjour",
            "ascii lowercase",
            "abc company",
            "section",
            "bonjour txt",
            "note",
            "ui element",
            "utf8 encoding",
            "nscopying",
            "nsdictionary",
            "nsstring",
            "mcextern",
            "attribute",
            "mcextern extern",
            "mcexternweak",
            "nsenum",
            "nsinteger",
            "mcerrorcode",
            "mcerrorunknown",
            "mcerrortimedout",
            "peer",
            "example",
            "bonjour apis",
            "stop",
            "tags",
            "session",
            "nsprogress",
            "nserror",
            "nsurl",
            "nsarray",
            "create",
            "nsuinteger",
            "notifies",
            "mcsession api",
            "interface",
            "dbictrace",
            "dbivporth",
            "dbictracelevel",
            "dbdtffoo",
            "dbihseterrchar",
            "dbicstate",
            "dbictraceflags",
            "provides macros",
            "dbi release",
            "only",
            "sqlsuccess",
            "odbc",
            "sqlok",
            "tim bunce",
            "england",
            "sql cli",
            "sql datatype",
            "sqlguid",
            "sqlwlongvarchar",
            "main",
            "beware",
            "sv sth",
            "sv dbh",
            "impsth",
            "impdbh",
            "sv keysv",
            "sv params",
            "sv attr",
            "sv attribs",
            "sv drh",
            "void",
            "fri jul",
            "mixed",
            "dbixsrevision",
            "plsvundef",
            "license",
            "spagain",
            "perlioprintf",
            "dbiclogpio",
            "putback",
            "ireland",
            "gnu general",
            "super",
            "magic",
            "dbicflags",
            "dbis",
            "svrv",
            "null",
            "imp2com",
            "dbicactivekids",
            "dbicfiadestroy",
            "sv h",
            "dbicdbistate",
            "code",
            "copy",
            "refer",
            "trace",
            "error",
            "unknown",
            "hookopcheckh",
            "startexternc",
            "hookopcheckcb",
            "userdata",
            "endexternc",
            "isinternalbuild",
            "kickmcxdforuid",
            "loadappkit",
            "ardconfig",
            "authenticator",
            "dsauthenticator",
            "dsnode",
            "dsrecord",
            "group",
            "hostconfig",
            "apfsvolumelock",
            "apfsvolumerole",
            "aoskgetosinfo",
            "aoskgetuserinfo",
            "aosaddappleid",
            "aosdisablepcs",
            "aosenablepcs",
            "aoslog",
            "aoslogforce",
            "aosrelaycookie",
            "didfailcallback",
            "kaosaccountkey",
            "kapcsbundle",
            "kapcspath",
            "kjsonextension",
            "apcsbucketid",
            "apcsreports",
            "apconfiguration",
            "apversiondata",
            "apversionhelper",
            "systemvolumesvm",
            "name size",
            "identifier",
            "gb disk0s3",
            "devdisk3",
            "apfs container",
            "scheme",
            "physical store",
            "macintosh hd",
            "apfs snapshot",
            "preboot",
            "refs address",
            "size wired",
            "name",
            "version",
            "uuid",
            "linked against",
            "renderer",
            "helper",
            "chrome helper",
            "contains",
            "cloud ui",
            "macintosh",
            "khtml",
            "gecko",
            "ui helper",
            "plugin",
            "service",
            "good",
            "battery power",
            "apfs encryption",
            "jumpcloud go",
            "chrome web",
            "store",
            "privacy badger",
            "flowcrypt",
            "encrypt gmail",
            "simple",
            "google",
            "b2b phone",
            "number",
            "apollo",
            "future",
            "exccrash",
            "sigkill",
            "code signature",
            "invalid",
            "sigabrt",
            "protonvpn",
            "excguard",
            "excbreakpoint",
            "sigtrap",
            "excbadaccess",
            "appl",
            "english",
            "adobe crash",
            "adobe",
            "acrobat dcadobe",
            "processor",
            "uninstaller",
            "assistant",
            "install",
            "cloud",
            "dock",
            "calendar",
            "music",
            "terminal",
            "tips",
            "installer",
            "updater",
            "proton",
            "tools",
            "stub",
            "python",
            "clock",
            "powershell",
            "team",
            "rave scout",
            "cookies",
            "public folder",
            "key cert",
            "sign",
            "crl sign",
            "root ca",
            "authority",
            "public primary",
            "global root",
            "verisign",
            "academic",
            "premium",
            "adaptive",
            "interactive",
            "background",
            "standard",
            "launchd sandbox",
            "s mdworker",
            "agent",
            "command line",
            "progress",
            "yubico",
            "macos13action",
            "disableoverride",
            "disableairdrop",
            "denyactivation",
            "enable",
            "loginwindowtext",
            "jumpcloud",
            "autoupdate",
            "loggingoption",
            "enablefirewall",
            "arm64e",
            "apple m2",
            "mac142",
            "kjqqtw7pqt",
            "daemon",
            "server",
            "open directory",
            "user",
            "account",
            "kerberos admin",
            "kerberos change",
            "device daemon",
            "network",
            "desktop",
            "screensaver",
            "bridge",
            "aesxtsarm",
            "aesecbarm",
            "sha512vngarmhw",
            "sha384vngarmhw",
            "sha256vngarm",
            "sha1vngarm",
            "darwin kernel",
            "wed mar",
            "wkarraycreate",
            "wkbooleancreate",
            "wkcontextcreate",
            "wkdatacreate",
            "wkdatagettypeid",
            "wkdoublecreate",
            "wkframecopyurl",
            "wkgettypeid",
            "wkimagecreate",
            "wkpagecandelete",
            "webview",
            "notice",
            "this software",
            "including",
            "but not",
            "limited to",
            "redistribution",
            "is provided",
            "by apple",
            "direct",
            "damage",
            "apiavailable",
            "webkit",
            "nsswiftname",
            "document",
            "a block",
            "as is",
            "hasinclude",
            "wkdownload",
            "abstract",
            "wkerrorcode",
            "wkerrorunknown",
            "discussion",
            "bool",
            "whether",
            "wkcontentworld",
            "wkwebview",
            "javascript",
            "nsunavailable",
            "vaargs",
            "nsswiftasync",
            "wkswiftasync",
            "wkcookiepolicy",
            "wkswiftuiactor",
            "nshttpcookie",
            "targetosiphone",
            "wknavigation",
            "decides",
            "boolean value",
            "apideprecated",
            "methodkind",
            "wkerrordomain",
            "wkscriptmessage",
            "promise",
            "fulfill",
            "const",
            "url scheme",
            "mark",
            "wkuserscript",
            "targetosvision",
            "param",
            "wkframeinfo",
            "targetosios",
            "pass",
            "window",
            "mime type",
            "link",
            "nsimage",
            "returns",
            "nsset",
            "checks",
            "matches",
            "a boolean",
            "defaults",
            "wkwebextension",
            "cgsize",
            "uiimage",
            "apis",
            "nsdate",
            "wkcontentmode",
            "wkextern",
            "possible",
            "cgfloat",
            "media",
            "cgrect",
            "apiunavailable",
            "framework",
            "nsswiftuiactor",
            "targetoswatch",
            "confirms",
            "apple upgrade",
            "nsstring user",
            "nsobject",
            "provider",
            "apple",
            "password",
            "uicontrol",
            "nscontrol",
            "asuseragerange",
            "check",
            "opaque user",
            "apple id",
            "initiate",
            "asauthorization",
            "operation",
            "state",
            "nserrorenum",
            "nsdata",
            "relying party",
            "asapiavailable",
            "perform",
            "realm",
            "http response",
            "authorization",
            "http",
            "oauth",
            "saml",
            "a byte",
            "nsdata userid",
            "relying",
            "a string",
            "nsdata readdata",
            "bool didwrite",
            "a cose",
            "nsdata first",
            "nsdata second",
            "nsstring name",
            "bool appid",
            "targetosxr",
            "nsstring appid",
            "bluetooth",
            "mdm profile",
            "nsurl url",
            "returns yes",
            "a state",
            "a json",
            "web token",
            "private seckeys",
            "enables",
            "keychain",
            "asswiftsendable",
            "cose algorithm",
            "ecdsa",
            "sha256",
            "cose curve",
            "p256",
            "nullable",
            "bool success",
            "remove",
            "call",
            "complete",
            "initializes",
            "time code",
            "extensions",
            "asextern extern",
            "asextern",
            "nsswiftsendable",
            "prepare",
            "list",
            "nsextension",
            "attempt",
            "nsstring label",
            "creates",
            "nsstring code",
            "a key",
            "webauthn",
            "nssecurecoding",
            "input",
            "output",
            "initialize",
            "nsinteger rank",
            "json",
            "inputs",
            "hash",
            "nsstring origin",
            "settings app",
            "extension",
            "https urls",
            "safari",
            "cancel",
            "nsuuid uuid",
            "r uftpexu",
            "nsmutabledata",
            "vnsdate",
            "mprcjy",
            "postfix",
            "domain",
            "canonical",
            "tables",
            "ldap",
            "post",
            "replace user",
            "address",
            "wietse venema",
            "bugs",
            "mail",
            "aliases",
            "postfix version",
            "restrict",
            "sample",
            "person",
            "basic system",
            "general",
            "reject empty",
            "postfix smtp",
            "ipv6 host",
            "reject",
            "reply",
            "access",
            "prior",
            "hold",
            "info",
            "mail delivery",
            "charset",
            "system",
            "report",
            "postfix dsn",
            "mail returned",
            "this",
            "generic",
            "smtp",
            "isp mail",
            "mime",
            "headerchecks",
            "readme files",
            "filters while",
            "posix",
            "empty",
            "body",
            "write",
            "date",
            "smtp server",
            "specify",
            "mx host",
            "unix password",
            "user unknown",
            "pathbin",
            "postfix queue",
            "unix",
            "cyrus",
            "path",
            "uucp",
            "shell",
            "local",
            "program",
            "agreement",
            "contributor",
            "recipient",
            "contribution",
            "the program",
            "corporation",
            "contributors",
            "product x",
            "as expressly",
            "arch",
            "arch x8664",
            "pipe wall",
            "wimplicit",
            "ranlib",
            "warn",
            "switch",
            "start",
            "systype",
            "outlook",
            "postfix master",
            "begin",
            "server admin",
            "mail backend",
            "modern smtp",
            "iana",
            "many",
            "postfix pipe",
            "recent cyrus",
            "amos gouaux",
            "old example",
            "or even",
            "lutz jaenicke",
            "technology",
            "cottbus",
            "germany",
            "openssl package",
            "openssl project",
            "europe",
            "remember that",
            "use of",
            "file",
            "update",
            "usrsbin",
            "file format",
            "no group",
            "daemondirectory",
            "deliver mail",
            "transport",
            "description",
            "result format",
            "virtual",
            "virtual alias",
            "redirect mail",
            "relocated",
            "matches user",
            "synopsis",
            "lastname",
            "firstname",
            "apple computer",
            "tcpip",
            "supported",
            "quantum",
            "facility",
            "level",
            "level info",
            "broadcast",
            "ignore",
            "rules",
            "sender",
            "automounter map",
            "use directory",
            "get home",
            "home autohome",
            "true",
            "t option",
            "mount",
            "force",
            "environment",
            "automountdenv",
            "promptcommand",
            "shellsessiondir",
            "histfile",
            "histfilesize",
            "myvar",
            "histtimeformat",
            "arrange",
            "bashrematch",
            "tell",
            "ps1h",
            "make bash",
            "s checkwinsize",
            "etcbashrc",
            "termprogram",
            "inpck",
            "nnnbaud",
            "berkeley",
            "parity",
            "pc entry",
            "pass8",
            "parenb istrip",
            "fixed speed",
            "entry",
            "clocal mode",
            "maxhistsize",
            "promptmode",
            "verbose end",
            "etcirbrcloaded",
            "default",
            "setup",
            "history file",
            "kernel",
            "readline",
            "jabber",
            "group database",
            "dovecot",
            "postfix scsd",
            "networkd",
            "searchpaths",
            "freebsd",
            "tmpdir",
            "fcodes",
            "prunepaths",
            "vartmp",
            "prunedirs",
            "filesystems",
            "nroff",
            "manpath",
            "uncomment",
            "manpager",
            "whatispager",
            "manlocale",
            "every",
            "manpath optman",
            "maybe",
            "troff",
            "status mailfrom",
            "returnpath via",
            "pidfile",
            "flags",
            "bcgjnuwz",
            "bin usrsbin",
            "sbin",
            "default pf",
            "care",
            "audio",
            "user database",
            "unix copy",
            "gate daemon",
            "bashno",
            "r etcbashrc",
            "rfc1323",
            "m1460",
            "macos x",
            "signature",
            "linux",
            "opera",
            "xp sp1",
            "windows sp1",
            "nmap syn",
            "m265",
            "synack",
            "mind",
            "macos",
            "warp",
            "ipv6",
            "internet",
            "icmp",
            "cisco",
            "monitoring",
            "argus",
            "chaos",
            "rsvp",
            "encapsulation",
            "aris",
            "isis",
            "netbootmount",
            "netbootshadow",
            "computername",
            "localonly",
            "localnetbootdir",
            "netboot",
            "define",
            "purpose",
            "networkonly",
            "waiting",
            "networkup",
            "term",
            "devnull",
            "common setup",
            "configure",
            "set command",
            "dns hostname",
            "dns query",
            "see also",
            "kame",
            "sunnet manager",
            "rpcsrc",
            "netlicense",
            "ftpd",
            "bindash binksh",
            "binsh bintcsh",
            "jumpcloud ldap",
            "smb2",
            "security",
            "workgroup",
            "standalone",
            "samba server",
            "enforce",
            "smb3",
            "example share",
            "improper use",
            "ctrlc",
            "none",
            "fax reception",
            "hardwired",
            "0007",
            "must",
            "visudo",
            "blocksize",
            "charset lang",
            "language lcall",
            "lines columns",
            "lscolors",
            "sshauthsock",
            "orion",
            "setup user",
            "home",
            "zdotdir",
            "delete",
            "beep",
            "vendor",
            "kf10",
            "kf11",
            "kf12",
            "kf13",
            "backspace",
            "insert",
            "resume",
            "termsessionid",
            "savehist",
            "sharehistory",
            "h do",
            "volume",
            "de l",
            "l uuid",
            "m tra",
            "n est",
            "suuid",
            "prfen",
            "fusion",
            "syst",
            "look",
            "executant",
            "alla",
            "over",
            "test",
            "overie",
            "zapis",
            "rapid",
            "disco usa",
            "de macos",
            "nie s",
            "i denne",
            "adgjmpsvx",
            "diskgthis disk",
            "01k8x j",
            "34disk",
            "levy kytt",
            "dict",
            "array",
            "plist",
            "apple root",
            "code signing",
            "inode64r",
            "xofkoxzh",
            "integer",
            "doctype",
            "brain",
            "abcd",
            "ogwo",
            "boaw",
            "cobwa",
            "uhawavauatsh",
            "ip bitmap",
            "foewdc",
            "could",
            "ip block",
            "funcs",
            "cogwo",
            "trash",
            "double",
            "hunt",
            "affa",
            "carr",
            "crypto",
            "docwbac",
            "q1b0",
            "q1 0",
            "h h5",
            "docwbag",
            "slice",
            "format",
            "zero",
            "alfa",
            "hera",
            "lelei",
            "hehe",
            "hisp",
            "fail",
            "katy",
            "zakk",
            "eodwcbgao",
            "hhk8di",
            "alma",
            "topo",
            "open",
            "huhk",
            "piper",
            "hehx",
            "eh ui",
            "h20hph",
            "hif h",
            "hmhhihqhyla hq",
            "r11b0",
            "target",
            "uus10u",
            "hifh",
            "loghookfailed",
            "loghook",
            "hell",
            "q1b 0",
            "f duh",
            "aqw1",
            "1160"
          ],
          "references": [
            "index.html.en",
            "bind.html",
            "caching.html",
            "BUILDING",
            "configuring.html",
            "content-negotiation.html",
            "custom-error.html",
            "convenience.map",
            "LDAP.tbd",
            "lber.h",
            "ldap.h",
            "LocalAuthentication.tbd",
            "arm64e-apple-macos.swiftinterface",
            "x86_64-apple-ios-macabi.swiftinterface",
            "arm64e-apple-ios-macabi.swiftinterface",
            "x86_64-apple-macos.swiftinterface",
            "MultipeerConnectivity.tbd",
            "module.modulemap",
            "MCNearbyServiceAdvertiser.h",
            "MCPeerID.h",
            "MCError.h",
            "MCNearbyServiceBrowser.h",
            "MCAdvertiserAssistant.h",
            "MultipeerConnectivity.apinotes",
            "MultipeerConnectivity.h",
            "MCSession.h",
            "MCBrowserViewController.h",
            "dbivport.h",
            "dbi_sql.h",
            "dbd_xsh.h",
            "dbixs_rev.h",
            "Driver_xst.h",
            "DBIXS.h",
            "hook_op_check.h",
            "Admin.tbd",
            "AirPlayReceiver.tbd",
            "apfs_boot_mount.tbd",
            "AOSKit.tbd",
            "APConfigurationSystem.tbd",
            "AppleFirmwareUpdate.tbd",
            "launchdaemons.txt",
            "preboot_archive_errors.log",
            "mounts.txt",
            "launchagents.txt",
            "disk_structure.txt",
            "user_launchagents.txt",
            "security_status.txt",
            "kexts.txt",
            "process_list.txt",
            "battery.csv",
            "diskEncryption.csv",
            "chromeExtensions.csv",
            "crashes.csv",
            "interfaceAddrs.csv",
            "kernel.csv",
            "interfaceDetails.csv",
            "etcHosts.csv",
            "applications.csv",
            "mounts.csv",
            "sharedFolders.csv",
            "certificates.csv",
            "sharingPreferences.csv",
            "launchD.csv",
            "usbDevices.csv",
            "managedPolicies.csv",
            "systemInfo.csv",
            "users.csv",
            "sipConfig.csv",
            "systemControls.csv",
            "canonical",
            "aliases",
            "custom_header_checks",
            "access",
            "bounce.cf.default",
            "generic",
            "header_checks",
            "main.cf.default",
            "LICENSE",
            "makedefs.out",
            "main.cf",
            "master.cf.default",
            "main.cf.proto",
            "master.cf.proto",
            "master.cf",
            "TLS_LICENSE",
            "postfix-files",
            "transport",
            "virtual",
            "relocated",
            "afpovertcp.cfg",
            "asl.conf",
            "auto_home",
            "auto_master",
            "autofs.conf",
            "bashrc_Apple_Terminal",
            "com.apple.screensharing.agent.launchd",
            "bashrc",
            "command_args.json",
            "csh.cshrc",
            "csh.login",
            "find.codes",
            "csh.logout",
            "ftpusers",
            "gettytab",
            "irbrc",
            "kern_loader.conf",
            "group",
            "locate.rc",
            "man.conf",
            "mail.rc",
            "manpaths",
            "networks",
            "nfs.conf",
            "newsyslog.conf",
            "ntp_opendirectory.conf",
            "ntp.conf",
            "notify.conf",
            "paths",
            "pf.conf",
            "passwd",
            "profile",
            "pf.os",
            "protocols",
            "rc.netboot",
            "rc.common",
            "rmtab",
            "resolv.conf",
            "rtadvd.conf",
            "rpc",
            "shells",
            "smb.conf",
            "sudo_lecture",
            "ttys",
            "syslog.conf",
            "xtab",
            "sudoers",
            "zprofile",
            "zshrc",
            "zshrc_Apple_Terminal",
            "CodeResources",
            "version.plist",
            "Info.plist"
          ],
          "public": 1,
          "adversary": "DragonForce Malaysia Hacker Group",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lastname",
              "display_name": "Lastname",
              "target": null
            },
            {
              "id": "Firstname",
              "display_name": "Firstname",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 66,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ilyailya",
            "id": "298851",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 4449,
            "domain": 3847,
            "URL": 14263,
            "FileHash-SHA256": 2356,
            "FileHash-MD5": 223,
            "FileHash-SHA1": 523,
            "email": 223,
            "CVE": 40,
            "CIDR": 12,
            "SSLCertFingerprint": 302
          },
          "indicator_count": 26238,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 35,
          "modified_text": "342 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f235b9a7a94a6a61acd651",
          "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
          "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
          "modified": "2025-03-07T08:38:08.584000",
          "created": "2024-09-24T03:44:57.902000",
          "tags": [
            "geoip",
            "public url",
            "as16509",
            "amazon02",
            "as20940",
            "akamaiasn1",
            "as8075",
            "as15169",
            "google",
            "akamaias",
            "facebook",
            "telecom",
            "twitter",
            "media",
            "win64",
            "level3",
            "mini",
            "ukraine",
            "proton",
            "ghost",
            "win32",
            "cuba",
            "mexico",
            "indonesia",
            "seznam",
            "as3359",
            "as852"
          ],
          "references": [
            "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
            "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
            "https://n0paste.eu/UH6n5pD/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Anguilla",
            "Poland",
            "Aruba",
            "Australia",
            "Barbados",
            "Costa Rica",
            "Guatemala",
            "Philippines",
            "Panama",
            "Sint Maarten (Dutch part)",
            "Saint Martin (French part)",
            "Cayman Islands",
            "Cura\u00e7ao",
            "Mexico",
            "Saint Vincent and the Grenadines",
            "Saint Kitts and Nevis",
            "Tanzania, United Republic of",
            "Netherlands",
            "Ukraine",
            "Trinidad and Tobago",
            "Japan",
            "Bahamas",
            "United Kingdom of Great Britain and Northern Ireland",
            "Georgia"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government",
            "Telecommunications",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1,
            "CIDR": 1186,
            "CVE": 4,
            "FileHash-MD5": 29,
            "FileHash-SHA1": 3,
            "URL": 25493,
            "domain": 5396,
            "email": 10,
            "hostname": 10770
          },
          "indicator_count": 42892,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 147,
          "modified_text": "408 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b0fa3624bf0384e427f2e7",
          "name": "Tracking Domains 4.2 - 08.19.24",
          "description": "Tracking Domains detected by Privacy Badger Ext. on Microsoft Edge Browser (W11 Device) using Telus ISP (ASN852)\n*Not-Enriched (08.05.24): ~50,000 suggests IOCs by AlienVault\nFrom VT: 2 IPs hosted by 45090 (Shenzhen Tencent Computer Systems Company Limited) & 4611 (CNNIC member) seem to be the problem here 118[.]89.204.198, 118[.]89.0.0/16 & 202[.]123.107.15, 202[.]123.107.0/24 (Respectively)",
          "modified": "2024-09-04T15:01:01.432000",
          "created": "2024-08-05T16:13:42.563000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
            "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
            "https://viz.greynoise.io/query/AS4611",
            "https://urlscan.io/asn/AS4611",
            "https://urlscan.io/search/#asn:%22AS4611%22",
            "https://urlscan.io/asn/AS45090",
            "https://urlscan.io/search/#asn%3A%22AS45090%22",
            "https://viz.greynoise.io/query/AS45090",
            "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
            "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
            "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
            "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6180,
            "FileHash-MD5": 1,
            "domain": 24921,
            "URL": 10854
          },
          "indicator_count": 41956,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "592 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66269b1f33258a8e26033b17",
          "name": "Tracking Domains - Part 4.1",
          "description": "More Tracking Domains",
          "modified": "2024-08-30T13:02:28.335000",
          "created": "2024-04-22T17:15:11.398000",
          "tags": [
            "Tracking Domains"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
            "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark",
            "https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 94496,
            "FileHash-MD5": 63,
            "domain": 112327,
            "URL": 166918,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 103,
            "CIDR": 216
          },
          "indicator_count": 374156,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "597 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66269b204ecfba63974dc1d8",
          "name": "Tracking Domains - Part 4",
          "description": "More Tracking Domains",
          "modified": "2024-05-22T17:04:45.215000",
          "created": "2024-04-22T17:15:12.353000",
          "tags": [
            "Tracking Domains"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
            "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 792,
            "FileHash-MD5": 1,
            "domain": 5803,
            "URL": 2
          },
          "indicator_count": 6598,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 135,
          "modified_text": "697 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f152513c2dcc0f4e3406e",
          "name": "Threat Network Root & Distribution Vectors Probe",
          "description": "",
          "modified": "2023-10-30T02:29:57.489000",
          "created": "2023-10-30T02:29:57.489000",
          "tags": [
            "Domains",
            "ip addresses",
            "URLs",
            "Files",
            "Alberta Health Services",
            "BEC",
            "Education",
            "University of Alberta",
            "Government of Alberta",
            "Covenant Health Alberta",
            "Telus Communications",
            "Canadian Universities",
            "Malicious Certificates",
            "Digital Identity Theft / Credential Theft"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
            "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
            "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
            "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
            "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
            "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
            "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
            "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary"
          ],
          "public": 1,
          "adversary": "Unknown APT Group(s) / Threat Actor (s)",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Philippines",
            "Panama",
            "Netherlands",
            "Anguilla",
            "Saint Vincent and the Grenadines",
            "Aruba",
            "Mexico",
            "Guatemala",
            "Costa Rica",
            "Tanzania, United Republic of"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "65133d6945641812c2ccc6ee",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 230,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 1197,
            "URL": 9276,
            "CIDR": 16,
            "domain": 7895,
            "email": 2,
            "hostname": 1965
          },
          "indicator_count": 20720,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "902 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1524792f3064843d826f",
          "name": "Threat Network Root & Distribution Vectors Probe",
          "description": "",
          "modified": "2023-10-30T02:29:56.006000",
          "created": "2023-10-30T02:29:56.006000",
          "tags": [
            "Domains",
            "ip addresses",
            "URLs",
            "Files",
            "Alberta Health Services",
            "BEC",
            "Education",
            "University of Alberta",
            "Government of Alberta",
            "Covenant Health Alberta",
            "Telus Communications",
            "Canadian Universities",
            "Malicious Certificates",
            "Digital Identity Theft / Credential Theft"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
            "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
            "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
            "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
            "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
            "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
            "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
            "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary"
          ],
          "public": 1,
          "adversary": "Unknown APT Group(s) / Threat Actor (s)",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Philippines",
            "Panama",
            "Netherlands",
            "Anguilla",
            "Saint Vincent and the Grenadines",
            "Aruba",
            "Mexico",
            "Guatemala",
            "Costa Rica",
            "Tanzania, United Republic of"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "65133d6945641812c2ccc6ee",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 230,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 1197,
            "URL": 9276,
            "CIDR": 16,
            "domain": 7895,
            "email": 2,
            "hostname": 1965
          },
          "indicator_count": 20720,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "902 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "650fda65975555b2dabc023e",
          "name": "Threat Network Root  & Distribution Vectors Probe ( disabe_duck curated pulse) ",
          "description": "",
          "modified": "2023-09-27T21:01:26.901000",
          "created": "2023-09-24T06:42:45.462000",
          "tags": [
            "Domains",
            "ip addresses",
            "URLs",
            "Files",
            "Alberta Health Services",
            "BEC",
            "Education",
            "University of Alberta",
            "Government of Alberta",
            "Covenant Health Alberta",
            "Telus Communications",
            "Canadian Universities",
            "Malicious Certificates",
            "Digital Identity Theft / Credential Theft"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
            "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
            "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
            "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
            "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
            "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
            "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
            "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary"
          ],
          "public": 1,
          "adversary": "Unknown APT Group(s) / Threat Actor (s)",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Philippines",
            "Panama",
            "Netherlands",
            "Anguilla",
            "Saint Vincent and the Grenadines",
            "Aruba",
            "Mexico",
            "Guatemala",
            "Costa Rica",
            "Tanzania, United Republic of"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "64ed117e2308a042e50e1e9e",
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 230,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 1197,
            "URL": 9276,
            "CIDR": 16,
            "domain": 7895,
            "email": 2,
            "hostname": 1965
          },
          "indicator_count": 20720,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "934 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65133d6945641812c2ccc6ee",
          "name": "Threat Network Root & Distribution Vectors Probe",
          "description": "",
          "modified": "2023-09-27T21:01:26.901000",
          "created": "2023-09-26T20:22:01.290000",
          "tags": [
            "Domains",
            "ip addresses",
            "URLs",
            "Files",
            "Alberta Health Services",
            "BEC",
            "Education",
            "University of Alberta",
            "Government of Alberta",
            "Covenant Health Alberta",
            "Telus Communications",
            "Canadian Universities",
            "Malicious Certificates",
            "Digital Identity Theft / Credential Theft"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
            "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
            "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
            "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
            "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
            "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
            "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
            "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary"
          ],
          "public": 1,
          "adversary": "Unknown APT Group(s) / Threat Actor (s)",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Philippines",
            "Panama",
            "Netherlands",
            "Anguilla",
            "Saint Vincent and the Grenadines",
            "Aruba",
            "Mexico",
            "Guatemala",
            "Costa Rica",
            "Tanzania, United Republic of"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "650fda65975555b2dabc023e",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 230,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 1197,
            "URL": 9276,
            "CIDR": 16,
            "domain": 7895,
            "email": 2,
            "hostname": 1965
          },
          "indicator_count": 20720,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "934 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/2cdadbf6aa2ec4f9815c038b0e9375b1475ac7e049fd123861d6e925e7802c6a",
        "users.csv",
        "asl.conf",
        "master.cf.proto",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188",
        "MCError.h",
        "aliases",
        "TLS_LICENSE",
        "MCAdvertiserAssistant.h",
        "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
        "kexts.txt",
        "paths",
        "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
        "LICENSE",
        "version.plist",
        "https://www.virustotal.com/graph/embed/g9219350397134ff3a645319a88b67833077c9cf0f50d4979aa0239a3d0b6ecea?theme=dark",
        "https://www.virustotal.com/graph/embed/g798b5e01446c4711ba22802009d71f5ba78553df16794088a907ae7456e2a017?theme=dark",
        "irbrc",
        "main.cf",
        "launchD.csv",
        "syslog.conf",
        "https://www.virustotal.com/gui/collection/a6a81c8412b19ac6357a7c6e978c31a38d52a75fbb3b2e44f0f1a2bf0deb8a58/iocs",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
        "https://urlscan.io/asn/AS45090",
        "profile",
        "pf.conf",
        "nfs.conf",
        "LDAP.tbd",
        "LocalAuthentication.tbd",
        "header_checks",
        "crashes.csv",
        "ntp_opendirectory.conf",
        "kernel.csv",
        "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
        "bind.html",
        "https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5/summary",
        "generic",
        "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
        "https://www.virustotal.com/graph/embed/g78ea5ea9b68b4a4bbcd2bc078e23b321985e72d90da146c19d8d80ede366c1fa?theme=dark",
        "systemControls.csv",
        "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
        "passwd",
        "etcHosts.csv",
        "sharingPreferences.csv",
        "rc.netboot",
        "bounce.cf.default",
        "zshrc",
        "rc.common",
        "AirPlayReceiver.tbd",
        "sharedFolders.csv",
        "group",
        "rmtab",
        "transport",
        "https://www.virustotal.com/gui/collection/6434f0cf09638991baf3be289834696b46e11c4c6cbe1e7b9548f9ac27372b53",
        "https://www.virustotal.com/gui/collection/ba238f4d585b87abb85c126f927090cb866facfa9e4e2e0db8e307aff553397d",
        "configuring.html",
        "MCPeerID.h",
        "https://viz.greynoise.io/ip/analysis/6356f330-63a7-4ce3-91fa-7ab355a1dc1a",
        "autofs.conf",
        "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
        "mounts.csv",
        "manpaths",
        "https://www.virustotal.com/graph/embed/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076?theme=dark",
        "ttys",
        "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
        "convenience.map",
        "custom_header_checks",
        "ftpusers",
        "man.conf",
        "main.cf.proto",
        "virtual",
        "https://www.virustotal.com/gui/collection/82dc29932b9184d02b037289fd4605c158e96a57f376b08a8b2b94e43d0ae18b/iocs",
        "ntp.conf",
        "https://www.virustotal.com/graph/g38632f8b939b443ab3b69f6a3171d02ffd2696a0f3714325a84b9a5f227a7d1c",
        "https://viz.greynoise.io/query/AS45090",
        "content-negotiation.html",
        "smb.conf",
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2",
        "Driver_xst.h",
        "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph",
        "zprofile",
        "master.cf.default",
        "https://www.virustotal.com/gui/collection/bc7e252dcc07855314e153efe890d70e7a7e9b8a743e171eac31e5951260c1b7",
        "find.codes",
        "https://urlscan.io/asn/AS4611",
        "master.cf",
        "interfaceAddrs.csv",
        "https://www.virustotal.com/graph/embed/g3dae42eb79cc447182e3a3dd746e462f0903d71c784d4f5cacf970954deea221?theme=dark",
        "disk_structure.txt",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/summary",
        "https://www.virustotal.com/gui/collection/da124f42943c08f1cafdc1c42635457b0c69ccce41b4031263af3235717996a2/summary",
        "https://urlscan.io/search/#asn:%22AS4611%22",
        "command_args.json",
        "Info.plist",
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "MCNearbyServiceAdvertiser.h",
        "dbivport.h",
        "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
        "launchdaemons.txt",
        "applications.csv",
        "newsyslog.conf",
        "https://viz.greynoise.io/query/AS4611",
        "MCNearbyServiceBrowser.h",
        "chromeExtensions.csv",
        "mail.rc",
        "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
        "https://hybrid-analysis.com/sample/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://www.virustotal.com/gui/collection/dbf356b0a281fa94308e2e24738d839491491bfb2defa4e6c42662646e52c8f8",
        "AppleFirmwareUpdate.tbd",
        "csh.login",
        "https://www.virustotal.com/graph/embed/g3b316b58b8c54064b322b2e186d62950d7632add2f3f408f8d8a1706563fd3c0?theme=dark",
        "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
        "MCSession.h",
        "https://app.threat.zone/submission/c8b0b1e4-0c9b-4210-b5ce-1dc2303445df/overview",
        "rtadvd.conf",
        "https://www.virustotal.com/gui/collection/1497c56a475d73236c67292964eabd7f8961f88c57fa5a2e3f30720dc29a51e7",
        "https://viz.greynoise.io/ip/analysis/ae06b3b5-c746-4b44-b2ac-19bb3aea14a1 [11.23.25 - 1000ipv4]",
        "caching.html",
        "bashrc",
        "afpovertcp.cfg",
        "sudo_lecture",
        "managedPolicies.csv",
        "apfs_boot_mount.tbd",
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
        "arm64e-apple-macos.swiftinterface",
        "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
        "process_list.txt",
        "CodeResources",
        "custom-error.html",
        "module.modulemap",
        "usbDevices.csv",
        "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary",
        "https://www.virustotal.com/gui/collection/daab0521ae533cbdfeec047e51a9499aedfd27c8cc05c644950126c1947131f9",
        "https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f",
        "Admin.tbd",
        "postfix-files",
        "x86_64-apple-ios-macabi.swiftinterface",
        "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
        "dbi_sql.h",
        "https://www.virustotal.com/graph/embed/g699a7b9bfb324855859555181d01666c372310cf233441e08a095459b3394dea?theme=dark",
        "MCBrowserViewController.h",
        "xtab",
        "arm64e-apple-ios-macabi.swiftinterface",
        "makedefs.out",
        "networks",
        "https://polyswarm.network/scan/results/file/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://www.virustotal.com/gui/collection/3bf1c0922ee6f4d041effbf9f72a21a1e9f4b38d0593cfbeaca24851cf712eac",
        "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
        "https://www.virustotal.com/graph/embed/g6d4bce6162064ac09cd20411c1947e69d7d5a1d475f0447da023ac933d338fce?theme=dark",
        "security_status.txt",
        "https://n0paste.eu/UH6n5pD/",
        "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327",
        "MultipeerConnectivity.apinotes",
        "AOSKit.tbd",
        "https://www.virustotal.com/gui/collection/8f89eb9579ca53d15294ec27a4c1e763998ce57d3644ea746621d9fe0cb57e55/iocs",
        "https://www.virustotal.com/gui/collection/4b166c2c1752d85215da951b15a065688bfe24ea92c65228a45ded6f2d94685b/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
        "https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f/iocs",
        "battery.csv",
        "access",
        "kern_loader.conf",
        "bashrc_Apple_Terminal",
        "locate.rc",
        "https://yaraify.abuse.ch/scan/results/32bfc760-1757-11f1-b47f-42010aa4000b",
        "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602",
        "canonical",
        "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs",
        "certificates.csv",
        "https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5",
        "user_launchagents.txt",
        "DBIXS.h",
        "pf.os",
        "protocols",
        "BUILDING",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs",
        "https://www.virustotal.com/gui/collection/a1866f4c7dbc79920d0c7e914a3bace0d3dc424a2aac06bf30bf724c6c8b0375/iocs",
        "main.cf.default",
        "x86_64-apple-macos.swiftinterface",
        "rpc",
        "index.html.en",
        "MultipeerConnectivity.h",
        "https://www.virustotal.com/gui/collection/6a4e699473879d39e15ed7cd130f2ee9543f842b92c9ad8b78e310968f4b086f",
        "mounts.txt",
        "https://www.virustotal.com/gui/collection/f60b8061133367a1047262a1e90d54cd72de4d59885c267906c6eeb557a35500",
        "launchagents.txt",
        "auto_master",
        "sipConfig.csv",
        "https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551",
        "https://www.virustotal.com/graph/embed/g6a67af8ffa22446da35d6989d7d0bc47efcd295eb893471e9b4912080c1dddef?theme=dark",
        "shells",
        "https://www.virustotal.com/gui/collection/0c9360cb9f8601bd6cdf912eb414d67902487f0c4eec96e952377e300ff4e983/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
        "https://www.virustotal.com/gui/collection/da35693aa528a682ca91aee332c8155d99ac8e4a13077cc73b2a8921c8fea36b",
        "MultipeerConnectivity.tbd",
        "preboot_archive_errors.log",
        "interfaceDetails.csv",
        "notify.conf",
        "https://www.virustotal.com/gui/collection/fd8ebe64d72b2ad9e90773791522c3ec5863868dc3b9c58a929c6b4e01bb3042",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
        "csh.cshrc",
        "systemInfo.csv",
        "gettytab",
        "APConfigurationSystem.tbd",
        "sudoers",
        "https://urlscan.io/search/#asn%3A%22AS45090%22",
        "https://wormhole.app/Pp5DdP#3EpzsqLhw5lJdQ0Xe_mRQA",
        "diskEncryption.csv",
        "zshrc_Apple_Terminal",
        "relocated",
        "resolv.conf",
        "https://www.virustotal.com/gui/collection/8228434e85241bd42ae063de8cf2ee2afb86f0848675ed11e3f33b967e8c3c7c",
        "ldap.h",
        "https://www.virustotal.com/gui/collection/12100cb4982365cfe5122fcedda2c084d60cebe09314846cae980c36fc90fc8c/iocs",
        "csh.logout",
        "hook_op_check.h",
        "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
        "https://www.virustotal.com/graph/g40f442f2b5d64cba818cac88855ba4ce274d109ce4ef4fb496f1af4efb993886",
        "dbd_xsh.h",
        "https://www.virustotal.com/graph/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076",
        "com.apple.screensharing.agent.launchd",
        "https://www.virustotal.com/graph/embed/gc0d82762363b4aa88991027c391afdbfe9585395bd8d4273bbe09907fbfaf532?theme=light",
        "dbixs_rev.h",
        "auto_home",
        "lber.h",
        "https://www.virustotal.com/graph/embed/g23481631a7c745c6ba19f72ce9f853643d17706c08ab44eb8851eb5c56c0f073?theme=dark"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Unknown APT Group(s) / Threat Actor (s)",
            "DragonForce Malaysia Hacker Group"
          ],
          "malware_families": [
            "Lastname",
            "Firstname"
          ],
          "industries": [
            "Technology",
            "Healthcare",
            "Education",
            "Telecommunications",
            "Government"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 13,
  "pulses": [
    {
      "id": "695089cbedad5c86f39b1363",
      "name": "Tracking Domains 03.03.26 (Updated Test)",
      "description": "Privacy Badger - Update on 01.09.26\nTracking domains on a hybrid (mobile laptop) clone of an AHS/Covenant Health, UAlberta (University of Alberta), and Government of Alberta Laptop.\nHealthcare: No Cybersecurity, EDU: No Cybersecurity / Remote only, GoA = Informed & don't quite know what to do or to whom this should be brought up with.",
      "modified": "2026-04-05T06:35:43.679000",
      "created": "2025-12-28T01:37:15.993000",
      "tags": [
        "privacy badger",
        "sites general",
        "settings widget",
        "domains manage",
        "data privacy",
        "badger",
        "hide"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://yaraify.abuse.ch/scan/results/32bfc760-1757-11f1-b47f-42010aa4000b",
        "https://polyswarm.network/scan/results/file/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://app.threat.zone/submission/c8b0b1e4-0c9b-4210-b5ce-1dc2303445df/overview",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/summary",
        "https://www.virustotal.com/graph/embed/g6d4bce6162064ac09cd20411c1947e69d7d5a1d475f0447da023ac933d338fce?theme=dark",
        "https://viz.greynoise.io/ip/analysis/6356f330-63a7-4ce3-91fa-7ab355a1dc1a"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Healthcare",
        "Government",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 50404,
        "hostname": 10879,
        "URL": 715,
        "FileHash-MD5": 1
      },
      "indicator_count": 61999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "14 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64ed117e2308a042e50e1e9e",
      "name": "Investigation of Distribution Vectors and Threat Network Infrastructure",
      "description": "Targets: Individual(s), University of Alberta Infrastructure, Covenant Health (Alberta Health Services), TELUS Communications (Network & Mobile infrastructure), Government of Alberta, Government of Canada. International entities spanning primarily government, healthcare, and educational institutions.",
      "modified": "2025-11-23T23:20:07.571000",
      "created": "2023-08-28T21:28:30.294000",
      "tags": [
        "Domains",
        "ip addresses",
        "URLs",
        "Files",
        "Alberta Health Services",
        "BEC",
        "Education",
        "University of Alberta",
        "Government of Alberta",
        "Covenant Health Alberta",
        "Telus Communications",
        "Canadian Universities",
        "Malicious Certificates",
        "Digital Identity Theft / Credential Theft"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
        "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
        "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
        "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
        "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
        "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
        "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
        "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary",
        "https://www.virustotal.com/gui/collection/3bf1c0922ee6f4d041effbf9f72a21a1e9f4b38d0593cfbeaca24851cf712eac",
        "https://www.virustotal.com/gui/collection/2cdadbf6aa2ec4f9815c038b0e9375b1475ac7e049fd123861d6e925e7802c6a",
        "https://www.virustotal.com/gui/collection/ba238f4d585b87abb85c126f927090cb866facfa9e4e2e0db8e307aff553397d",
        "https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5/summary",
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2",
        "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327",
        "https://www.virustotal.com/gui/collection/fd8ebe64d72b2ad9e90773791522c3ec5863868dc3b9c58a929c6b4e01bb3042",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
        "https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5",
        "https://www.virustotal.com/gui/collection/6434f0cf09638991baf3be289834696b46e11c4c6cbe1e7b9548f9ac27372b53",
        "https://www.virustotal.com/gui/collection/bc7e252dcc07855314e153efe890d70e7a7e9b8a743e171eac31e5951260c1b7",
        "https://www.virustotal.com/gui/collection/dbf356b0a281fa94308e2e24738d839491491bfb2defa4e6c42662646e52c8f8",
        "https://www.virustotal.com/gui/collection/f60b8061133367a1047262a1e90d54cd72de4d59885c267906c6eeb557a35500",
        "https://www.virustotal.com/gui/collection/da124f42943c08f1cafdc1c42635457b0c69ccce41b4031263af3235717996a2/summary",
        "https://www.virustotal.com/gui/collection/daab0521ae533cbdfeec047e51a9499aedfd27c8cc05c644950126c1947131f9",
        "https://www.virustotal.com/gui/collection/12100cb4982365cfe5122fcedda2c084d60cebe09314846cae980c36fc90fc8c/iocs",
        "https://www.virustotal.com/graph/embed/g9219350397134ff3a645319a88b67833077c9cf0f50d4979aa0239a3d0b6ecea?theme=dark",
        "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602",
        "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph",
        "https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs",
        "https://www.virustotal.com/gui/collection/da35693aa528a682ca91aee332c8155d99ac8e4a13077cc73b2a8921c8fea36b",
        "https://www.virustotal.com/gui/collection/1497c56a475d73236c67292964eabd7f8961f88c57fa5a2e3f30720dc29a51e7",
        "https://www.virustotal.com/gui/collection/8228434e85241bd42ae063de8cf2ee2afb86f0848675ed11e3f33b967e8c3c7c",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188",
        "https://www.virustotal.com/gui/collection/6a4e699473879d39e15ed7cd130f2ee9543f842b92c9ad8b78e310968f4b086f",
        "https://www.virustotal.com/graph/embed/g3dae42eb79cc447182e3a3dd746e462f0903d71c784d4f5cacf970954deea221?theme=dark",
        "https://www.virustotal.com/graph/embed/gc0d82762363b4aa88991027c391afdbfe9585395bd8d4273bbe09907fbfaf532?theme=light",
        "https://www.virustotal.com/graph/embed/g78ea5ea9b68b4a4bbcd2bc078e23b321985e72d90da146c19d8d80ede366c1fa?theme=dark",
        "https://www.virustotal.com/gui/collection/8f89eb9579ca53d15294ec27a4c1e763998ce57d3644ea746621d9fe0cb57e55/iocs",
        "https://www.virustotal.com/graph/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076",
        "https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f/iocs",
        "https://www.virustotal.com/graph/g38632f8b939b443ab3b69f6a3171d02ffd2696a0f3714325a84b9a5f227a7d1c",
        "https://www.virustotal.com/gui/collection/4b166c2c1752d85215da951b15a065688bfe24ea92c65228a45ded6f2d94685b/iocs",
        "https://www.virustotal.com/graph/embed/g798b5e01446c4711ba22802009d71f5ba78553df16794088a907ae7456e2a017?theme=dark",
        "https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f",
        "https://www.virustotal.com/gui/collection/a6a81c8412b19ac6357a7c6e978c31a38d52a75fbb3b2e44f0f1a2bf0deb8a58/iocs",
        "https://www.virustotal.com/graph/embed/g699a7b9bfb324855859555181d01666c372310cf233441e08a095459b3394dea?theme=dark",
        "https://www.virustotal.com/graph/embed/g6a67af8ffa22446da35d6989d7d0bc47efcd295eb893471e9b4912080c1dddef?theme=dark",
        "https://www.virustotal.com/graph/embed/g23481631a7c745c6ba19f72ce9f853643d17706c08ab44eb8851eb5c56c0f073?theme=dark",
        "https://www.virustotal.com/graph/embed/g3b316b58b8c54064b322b2e186d62950d7632add2f3f408f8d8a1706563fd3c0?theme=dark",
        "https://www.virustotal.com/graph/embed/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076?theme=dark",
        "https://www.virustotal.com/graph/g40f442f2b5d64cba818cac88855ba4ce274d109ce4ef4fb496f1af4efb993886",
        "https://www.virustotal.com/gui/collection/0c9360cb9f8601bd6cdf912eb414d67902487f0c4eec96e952377e300ff4e983/iocs",
        "https://www.virustotal.com/gui/collection/a1866f4c7dbc79920d0c7e914a3bace0d3dc424a2aac06bf30bf724c6c8b0375/iocs",
        "https://www.virustotal.com/gui/collection/82dc29932b9184d02b037289fd4605c158e96a57f376b08a8b2b94e43d0ae18b/iocs",
        "https://viz.greynoise.io/ip/analysis/ae06b3b5-c746-4b44-b2ac-19bb3aea14a1 [11.23.25 - 1000ipv4]"
      ],
      "public": 1,
      "adversary": "Unknown APT Group(s) / Threat Actor (s)",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Philippines",
        "Panama",
        "Netherlands",
        "Anguilla",
        "Saint Vincent and the Grenadines",
        "Aruba",
        "Mexico",
        "Guatemala",
        "Costa Rica",
        "Tanzania, United Republic of"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 111,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 236,
        "FileHash-SHA1": 139,
        "FileHash-SHA256": 1421,
        "URL": 9580,
        "CIDR": 30,
        "domain": 10205,
        "email": 12,
        "hostname": 517612,
        "IPv4": 11,
        "CVE": 62
      },
      "indicator_count": 539308,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "691b61e16cea7624a6606a69",
      "name": "For Later",
      "description": "***",
      "modified": "2025-11-17T18:46:19.094000",
      "created": "2025-11-17T17:56:49.875000",
      "tags": [
        "wormhole",
        "want",
        "sign",
        "submit send",
        "copy",
        "share show",
        "report delete",
        "faq roadmap",
        "security legal",
        "twitter discord",
        "protected"
      ],
      "references": [
        "https://wormhole.app/Pp5DdP#3EpzsqLhw5lJdQ0Xe_mRQA",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 72127,
        "hostname": 16700,
        "URL": 50
      },
      "indicator_count": 88877,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "152 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "688ef0516013ca78448bf4e5",
      "name": "Foundry \u2022 Reflected Networks Pornhub Malvertising Subsidiary",
      "description": "Foundry ?  Pornhub\nsanfoundry.com\ncompliance.fifoundry.net- Pornhub subsidiary. Targets networks, devices, routers, used for promoting pornography and her music. Producer revealed her hooks were used for Justin Bieber &  Tori Kelly songs that. A producer stated her songs had been grifted. Both Tsara Brashears & a studio were in Pegasus & attacked by \u2018Lazarus\u2019 Group. She was told in detail how her songs can be used by music insiders if they choose.  Target trolled by mocking hackers re: the JB and Kelly song.. Trojan:Win32/DisableUAC.A!bit\n, MSIL:Suspicious:ScreenCapture.S01\nIDS Detections\nLokiBot Checkin\nLokiBot User-Agent (Charon/Inferno)\nLokiBot Application/Credential Data Exfiltration Detected M1\nLokiBot Request for C2 Commands Detected M1\nLokiBot Application/Credential Data Exfiltration Detected M2\nLokiBot Request for C2 Commands Detected M2\nTrojan Generic - POST To gate.php with no referer\nSSL excessive fatal alerts (possible POODLE attack against server)\nI will revisit this. Gloryhole Foundation?",
      "modified": "2025-09-02T04:01:31.218000",
      "created": "2025-08-03T05:14:57.402000",
      "tags": [
        "united",
        "moved",
        "entries",
        "passive dns",
        "detected m1",
        "next associated",
        "mtb apr",
        "mtb aug",
        "server",
        "gmt content",
        "trojandropper",
        "trojan",
        "body",
        "lokibot request",
        "c2 commands",
        "detected m2",
        "otx telemetry",
        "historical otx",
        "twitter running",
        "open ports",
        "cves",
        "time",
        "dynamicloader",
        "port",
        "search",
        "show",
        "destination",
        "alerts",
        "copy",
        "dynamic",
        "medium",
        "write",
        "creation date",
        "hostmaster",
        "urls",
        "domain",
        "showing",
        "hostname add",
        "pulse pulses",
        "date",
        "flag",
        "falcon sandbox",
        "name server",
        "markmonitor",
        "analysis",
        "mitre att",
        "anonymous",
        "upgrade",
        "hybrid",
        "contact",
        "usa windows",
        "december",
        "input threat",
        "level analysis",
        "summary",
        "february",
        "hwp support",
        "january",
        "october",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "calls",
        "command",
        "javascript",
        "object model",
        "model",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "temp",
        "getprocaddress",
        "script",
        "license",
        "runtime process",
        "copy md5",
        "facebook",
        "roboto",
        "error",
        "win64",
        "path",
        "blink",
        "meta",
        "factory",
        "general",
        "comspec",
        "click",
        "strings",
        "damage",
        "mini",
        "stop",
        "core",
        "expl",
        "win32",
        "gmt server",
        "ecacc saa83dd",
        "ipv4 add",
        "twitter",
        "cobalt strike",
        "mozilla"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 263,
        "FileHash-SHA1": 256,
        "FileHash-SHA256": 837,
        "hostname": 4415,
        "URL": 1918,
        "domain": 1884,
        "email": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9577,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "229 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67f5555b6ce863d998e83e26",
      "name": "macOS Threat Infrastructure Leveraging Remote Agents via remotewd.com and rtmsprod.net",
      "description": "This pulse identifies an actively observed macOS-focused remote access infrastructure abusing trusted native Apple agents (ARDAgent.app, SSMenuAgent.app) and communicating with a distributed network of C2-like endpoints under domains such as remotewd.com, idsremoteurlconnectionagent.app, and rtmsprod.net.\n\nThe infrastructure is composed of dynamically generated subdomains \u2014 many in the form of device-<UUID>.remotewd.com \u2014 indicative of automated deployment, system tracking, or per-host remote access configurations.\n\nAdditional indicators include HTTP/S URLs pointing directly to embedded binary paths within macOS agents, suggesting possible delivery vectors, staging, or persistence techniques.\n\nThis campaign shows signs of structured, programmatic targeting and is highly likely to be pre-operational infrastructure for wide-scale surveillance or access operations. All listed indicators should be considered high-risk. If observed in your environment, initiate a full forensic and IR process immediately.",
      "modified": "2025-05-11T19:03:59.885000",
      "created": "2025-04-08T16:56:59.641000",
      "tags": [
        "generated from",
        "do not",
        "edit uri",
        "urls",
        "edit",
        "rewriteengine",
        "rewritecond",
        "rewriterule",
        "r301",
        "xml2encalias",
        "beralloct",
        "berbvarrayadd",
        "berbvarrayfree",
        "berbvdup",
        "berbvecadd",
        "berbvecfree",
        "berbvfree",
        "berdump",
        "berdup",
        "berdupbv",
        "laerrordomain",
        "laerrornoncekey",
        "lamechanismtree",
        "lacontext",
        "ladomainstate",
        "laenvironment",
        "lanotification",
        "laprivatekey",
        "lapublickey",
        "laright",
        "apple swift",
        "o librarylevel",
        "combine import",
        "foundation",
        "swift import",
        "mcpeerid",
        "mcsession",
        "property",
        "copyright",
        "protocol",
        "class",
        "bonjour",
        "ascii lowercase",
        "abc company",
        "section",
        "bonjour txt",
        "note",
        "ui element",
        "utf8 encoding",
        "nscopying",
        "nsdictionary",
        "nsstring",
        "mcextern",
        "attribute",
        "mcextern extern",
        "mcexternweak",
        "nsenum",
        "nsinteger",
        "mcerrorcode",
        "mcerrorunknown",
        "mcerrortimedout",
        "peer",
        "example",
        "bonjour apis",
        "stop",
        "tags",
        "session",
        "nsprogress",
        "nserror",
        "nsurl",
        "nsarray",
        "create",
        "nsuinteger",
        "notifies",
        "mcsession api",
        "interface",
        "dbictrace",
        "dbivporth",
        "dbictracelevel",
        "dbdtffoo",
        "dbihseterrchar",
        "dbicstate",
        "dbictraceflags",
        "provides macros",
        "dbi release",
        "only",
        "sqlsuccess",
        "odbc",
        "sqlok",
        "tim bunce",
        "england",
        "sql cli",
        "sql datatype",
        "sqlguid",
        "sqlwlongvarchar",
        "main",
        "beware",
        "sv sth",
        "sv dbh",
        "impsth",
        "impdbh",
        "sv keysv",
        "sv params",
        "sv attr",
        "sv attribs",
        "sv drh",
        "void",
        "fri jul",
        "mixed",
        "dbixsrevision",
        "plsvundef",
        "license",
        "spagain",
        "perlioprintf",
        "dbiclogpio",
        "putback",
        "ireland",
        "gnu general",
        "super",
        "magic",
        "dbicflags",
        "dbis",
        "svrv",
        "null",
        "imp2com",
        "dbicactivekids",
        "dbicfiadestroy",
        "sv h",
        "dbicdbistate",
        "code",
        "copy",
        "refer",
        "trace",
        "error",
        "unknown",
        "hookopcheckh",
        "startexternc",
        "hookopcheckcb",
        "userdata",
        "endexternc",
        "isinternalbuild",
        "kickmcxdforuid",
        "loadappkit",
        "ardconfig",
        "authenticator",
        "dsauthenticator",
        "dsnode",
        "dsrecord",
        "group",
        "hostconfig",
        "apfsvolumelock",
        "apfsvolumerole",
        "aoskgetosinfo",
        "aoskgetuserinfo",
        "aosaddappleid",
        "aosdisablepcs",
        "aosenablepcs",
        "aoslog",
        "aoslogforce",
        "aosrelaycookie",
        "didfailcallback",
        "kaosaccountkey",
        "kapcsbundle",
        "kapcspath",
        "kjsonextension",
        "apcsbucketid",
        "apcsreports",
        "apconfiguration",
        "apversiondata",
        "apversionhelper",
        "systemvolumesvm",
        "name size",
        "identifier",
        "gb disk0s3",
        "devdisk3",
        "apfs container",
        "scheme",
        "physical store",
        "macintosh hd",
        "apfs snapshot",
        "preboot",
        "refs address",
        "size wired",
        "name",
        "version",
        "uuid",
        "linked against",
        "renderer",
        "helper",
        "chrome helper",
        "contains",
        "cloud ui",
        "macintosh",
        "khtml",
        "gecko",
        "ui helper",
        "plugin",
        "service",
        "good",
        "battery power",
        "apfs encryption",
        "jumpcloud go",
        "chrome web",
        "store",
        "privacy badger",
        "flowcrypt",
        "encrypt gmail",
        "simple",
        "google",
        "b2b phone",
        "number",
        "apollo",
        "future",
        "exccrash",
        "sigkill",
        "code signature",
        "invalid",
        "sigabrt",
        "protonvpn",
        "excguard",
        "excbreakpoint",
        "sigtrap",
        "excbadaccess",
        "appl",
        "english",
        "adobe crash",
        "adobe",
        "acrobat dcadobe",
        "processor",
        "uninstaller",
        "assistant",
        "install",
        "cloud",
        "dock",
        "calendar",
        "music",
        "terminal",
        "tips",
        "installer",
        "updater",
        "proton",
        "tools",
        "stub",
        "python",
        "clock",
        "powershell",
        "team",
        "rave scout",
        "cookies",
        "public folder",
        "key cert",
        "sign",
        "crl sign",
        "root ca",
        "authority",
        "public primary",
        "global root",
        "verisign",
        "academic",
        "premium",
        "adaptive",
        "interactive",
        "background",
        "standard",
        "launchd sandbox",
        "s mdworker",
        "agent",
        "command line",
        "progress",
        "yubico",
        "macos13action",
        "disableoverride",
        "disableairdrop",
        "denyactivation",
        "enable",
        "loginwindowtext",
        "jumpcloud",
        "autoupdate",
        "loggingoption",
        "enablefirewall",
        "arm64e",
        "apple m2",
        "mac142",
        "kjqqtw7pqt",
        "daemon",
        "server",
        "open directory",
        "user",
        "account",
        "kerberos admin",
        "kerberos change",
        "device daemon",
        "network",
        "desktop",
        "screensaver",
        "bridge",
        "aesxtsarm",
        "aesecbarm",
        "sha512vngarmhw",
        "sha384vngarmhw",
        "sha256vngarm",
        "sha1vngarm",
        "darwin kernel",
        "wed mar",
        "wkarraycreate",
        "wkbooleancreate",
        "wkcontextcreate",
        "wkdatacreate",
        "wkdatagettypeid",
        "wkdoublecreate",
        "wkframecopyurl",
        "wkgettypeid",
        "wkimagecreate",
        "wkpagecandelete",
        "webview",
        "notice",
        "this software",
        "including",
        "but not",
        "limited to",
        "redistribution",
        "is provided",
        "by apple",
        "direct",
        "damage",
        "apiavailable",
        "webkit",
        "nsswiftname",
        "document",
        "a block",
        "as is",
        "hasinclude",
        "wkdownload",
        "abstract",
        "wkerrorcode",
        "wkerrorunknown",
        "discussion",
        "bool",
        "whether",
        "wkcontentworld",
        "wkwebview",
        "javascript",
        "nsunavailable",
        "vaargs",
        "nsswiftasync",
        "wkswiftasync",
        "wkcookiepolicy",
        "wkswiftuiactor",
        "nshttpcookie",
        "targetosiphone",
        "wknavigation",
        "decides",
        "boolean value",
        "apideprecated",
        "methodkind",
        "wkerrordomain",
        "wkscriptmessage",
        "promise",
        "fulfill",
        "const",
        "url scheme",
        "mark",
        "wkuserscript",
        "targetosvision",
        "param",
        "wkframeinfo",
        "targetosios",
        "pass",
        "window",
        "mime type",
        "link",
        "nsimage",
        "returns",
        "nsset",
        "checks",
        "matches",
        "a boolean",
        "defaults",
        "wkwebextension",
        "cgsize",
        "uiimage",
        "apis",
        "nsdate",
        "wkcontentmode",
        "wkextern",
        "possible",
        "cgfloat",
        "media",
        "cgrect",
        "apiunavailable",
        "framework",
        "nsswiftuiactor",
        "targetoswatch",
        "confirms",
        "apple upgrade",
        "nsstring user",
        "nsobject",
        "provider",
        "apple",
        "password",
        "uicontrol",
        "nscontrol",
        "asuseragerange",
        "check",
        "opaque user",
        "apple id",
        "initiate",
        "asauthorization",
        "operation",
        "state",
        "nserrorenum",
        "nsdata",
        "relying party",
        "asapiavailable",
        "perform",
        "realm",
        "http response",
        "authorization",
        "http",
        "oauth",
        "saml",
        "a byte",
        "nsdata userid",
        "relying",
        "a string",
        "nsdata readdata",
        "bool didwrite",
        "a cose",
        "nsdata first",
        "nsdata second",
        "nsstring name",
        "bool appid",
        "targetosxr",
        "nsstring appid",
        "bluetooth",
        "mdm profile",
        "nsurl url",
        "returns yes",
        "a state",
        "a json",
        "web token",
        "private seckeys",
        "enables",
        "keychain",
        "asswiftsendable",
        "cose algorithm",
        "ecdsa",
        "sha256",
        "cose curve",
        "p256",
        "nullable",
        "bool success",
        "remove",
        "call",
        "complete",
        "initializes",
        "time code",
        "extensions",
        "asextern extern",
        "asextern",
        "nsswiftsendable",
        "prepare",
        "list",
        "nsextension",
        "attempt",
        "nsstring label",
        "creates",
        "nsstring code",
        "a key",
        "webauthn",
        "nssecurecoding",
        "input",
        "output",
        "initialize",
        "nsinteger rank",
        "json",
        "inputs",
        "hash",
        "nsstring origin",
        "settings app",
        "extension",
        "https urls",
        "safari",
        "cancel",
        "nsuuid uuid",
        "r uftpexu",
        "nsmutabledata",
        "vnsdate",
        "mprcjy",
        "postfix",
        "domain",
        "canonical",
        "tables",
        "ldap",
        "post",
        "replace user",
        "address",
        "wietse venema",
        "bugs",
        "mail",
        "aliases",
        "postfix version",
        "restrict",
        "sample",
        "person",
        "basic system",
        "general",
        "reject empty",
        "postfix smtp",
        "ipv6 host",
        "reject",
        "reply",
        "access",
        "prior",
        "hold",
        "info",
        "mail delivery",
        "charset",
        "system",
        "report",
        "postfix dsn",
        "mail returned",
        "this",
        "generic",
        "smtp",
        "isp mail",
        "mime",
        "headerchecks",
        "readme files",
        "filters while",
        "posix",
        "empty",
        "body",
        "write",
        "date",
        "smtp server",
        "specify",
        "mx host",
        "unix password",
        "user unknown",
        "pathbin",
        "postfix queue",
        "unix",
        "cyrus",
        "path",
        "uucp",
        "shell",
        "local",
        "program",
        "agreement",
        "contributor",
        "recipient",
        "contribution",
        "the program",
        "corporation",
        "contributors",
        "product x",
        "as expressly",
        "arch",
        "arch x8664",
        "pipe wall",
        "wimplicit",
        "ranlib",
        "warn",
        "switch",
        "start",
        "systype",
        "outlook",
        "postfix master",
        "begin",
        "server admin",
        "mail backend",
        "modern smtp",
        "iana",
        "many",
        "postfix pipe",
        "recent cyrus",
        "amos gouaux",
        "old example",
        "or even",
        "lutz jaenicke",
        "technology",
        "cottbus",
        "germany",
        "openssl package",
        "openssl project",
        "europe",
        "remember that",
        "use of",
        "file",
        "update",
        "usrsbin",
        "file format",
        "no group",
        "daemondirectory",
        "deliver mail",
        "transport",
        "description",
        "result format",
        "virtual",
        "virtual alias",
        "redirect mail",
        "relocated",
        "matches user",
        "synopsis",
        "lastname",
        "firstname",
        "apple computer",
        "tcpip",
        "supported",
        "quantum",
        "facility",
        "level",
        "level info",
        "broadcast",
        "ignore",
        "rules",
        "sender",
        "automounter map",
        "use directory",
        "get home",
        "home autohome",
        "true",
        "t option",
        "mount",
        "force",
        "environment",
        "automountdenv",
        "promptcommand",
        "shellsessiondir",
        "histfile",
        "histfilesize",
        "myvar",
        "histtimeformat",
        "arrange",
        "bashrematch",
        "tell",
        "ps1h",
        "make bash",
        "s checkwinsize",
        "etcbashrc",
        "termprogram",
        "inpck",
        "nnnbaud",
        "berkeley",
        "parity",
        "pc entry",
        "pass8",
        "parenb istrip",
        "fixed speed",
        "entry",
        "clocal mode",
        "maxhistsize",
        "promptmode",
        "verbose end",
        "etcirbrcloaded",
        "default",
        "setup",
        "history file",
        "kernel",
        "readline",
        "jabber",
        "group database",
        "dovecot",
        "postfix scsd",
        "networkd",
        "searchpaths",
        "freebsd",
        "tmpdir",
        "fcodes",
        "prunepaths",
        "vartmp",
        "prunedirs",
        "filesystems",
        "nroff",
        "manpath",
        "uncomment",
        "manpager",
        "whatispager",
        "manlocale",
        "every",
        "manpath optman",
        "maybe",
        "troff",
        "status mailfrom",
        "returnpath via",
        "pidfile",
        "flags",
        "bcgjnuwz",
        "bin usrsbin",
        "sbin",
        "default pf",
        "care",
        "audio",
        "user database",
        "unix copy",
        "gate daemon",
        "bashno",
        "r etcbashrc",
        "rfc1323",
        "m1460",
        "macos x",
        "signature",
        "linux",
        "opera",
        "xp sp1",
        "windows sp1",
        "nmap syn",
        "m265",
        "synack",
        "mind",
        "macos",
        "warp",
        "ipv6",
        "internet",
        "icmp",
        "cisco",
        "monitoring",
        "argus",
        "chaos",
        "rsvp",
        "encapsulation",
        "aris",
        "isis",
        "netbootmount",
        "netbootshadow",
        "computername",
        "localonly",
        "localnetbootdir",
        "netboot",
        "define",
        "purpose",
        "networkonly",
        "waiting",
        "networkup",
        "term",
        "devnull",
        "common setup",
        "configure",
        "set command",
        "dns hostname",
        "dns query",
        "see also",
        "kame",
        "sunnet manager",
        "rpcsrc",
        "netlicense",
        "ftpd",
        "bindash binksh",
        "binsh bintcsh",
        "jumpcloud ldap",
        "smb2",
        "security",
        "workgroup",
        "standalone",
        "samba server",
        "enforce",
        "smb3",
        "example share",
        "improper use",
        "ctrlc",
        "none",
        "fax reception",
        "hardwired",
        "0007",
        "must",
        "visudo",
        "blocksize",
        "charset lang",
        "language lcall",
        "lines columns",
        "lscolors",
        "sshauthsock",
        "orion",
        "setup user",
        "home",
        "zdotdir",
        "delete",
        "beep",
        "vendor",
        "kf10",
        "kf11",
        "kf12",
        "kf13",
        "backspace",
        "insert",
        "resume",
        "termsessionid",
        "savehist",
        "sharehistory",
        "h do",
        "volume",
        "de l",
        "l uuid",
        "m tra",
        "n est",
        "suuid",
        "prfen",
        "fusion",
        "syst",
        "look",
        "executant",
        "alla",
        "over",
        "test",
        "overie",
        "zapis",
        "rapid",
        "disco usa",
        "de macos",
        "nie s",
        "i denne",
        "adgjmpsvx",
        "diskgthis disk",
        "01k8x j",
        "34disk",
        "levy kytt",
        "dict",
        "array",
        "plist",
        "apple root",
        "code signing",
        "inode64r",
        "xofkoxzh",
        "integer",
        "doctype",
        "brain",
        "abcd",
        "ogwo",
        "boaw",
        "cobwa",
        "uhawavauatsh",
        "ip bitmap",
        "foewdc",
        "could",
        "ip block",
        "funcs",
        "cogwo",
        "trash",
        "double",
        "hunt",
        "affa",
        "carr",
        "crypto",
        "docwbac",
        "q1b0",
        "q1 0",
        "h h5",
        "docwbag",
        "slice",
        "format",
        "zero",
        "alfa",
        "hera",
        "lelei",
        "hehe",
        "hisp",
        "fail",
        "katy",
        "zakk",
        "eodwcbgao",
        "hhk8di",
        "alma",
        "topo",
        "open",
        "huhk",
        "piper",
        "hehx",
        "eh ui",
        "h20hph",
        "hif h",
        "hmhhihqhyla hq",
        "r11b0",
        "target",
        "uus10u",
        "hifh",
        "loghookfailed",
        "loghook",
        "hell",
        "q1b 0",
        "f duh",
        "aqw1",
        "1160"
      ],
      "references": [
        "index.html.en",
        "bind.html",
        "caching.html",
        "BUILDING",
        "configuring.html",
        "content-negotiation.html",
        "custom-error.html",
        "convenience.map",
        "LDAP.tbd",
        "lber.h",
        "ldap.h",
        "LocalAuthentication.tbd",
        "arm64e-apple-macos.swiftinterface",
        "x86_64-apple-ios-macabi.swiftinterface",
        "arm64e-apple-ios-macabi.swiftinterface",
        "x86_64-apple-macos.swiftinterface",
        "MultipeerConnectivity.tbd",
        "module.modulemap",
        "MCNearbyServiceAdvertiser.h",
        "MCPeerID.h",
        "MCError.h",
        "MCNearbyServiceBrowser.h",
        "MCAdvertiserAssistant.h",
        "MultipeerConnectivity.apinotes",
        "MultipeerConnectivity.h",
        "MCSession.h",
        "MCBrowserViewController.h",
        "dbivport.h",
        "dbi_sql.h",
        "dbd_xsh.h",
        "dbixs_rev.h",
        "Driver_xst.h",
        "DBIXS.h",
        "hook_op_check.h",
        "Admin.tbd",
        "AirPlayReceiver.tbd",
        "apfs_boot_mount.tbd",
        "AOSKit.tbd",
        "APConfigurationSystem.tbd",
        "AppleFirmwareUpdate.tbd",
        "launchdaemons.txt",
        "preboot_archive_errors.log",
        "mounts.txt",
        "launchagents.txt",
        "disk_structure.txt",
        "user_launchagents.txt",
        "security_status.txt",
        "kexts.txt",
        "process_list.txt",
        "battery.csv",
        "diskEncryption.csv",
        "chromeExtensions.csv",
        "crashes.csv",
        "interfaceAddrs.csv",
        "kernel.csv",
        "interfaceDetails.csv",
        "etcHosts.csv",
        "applications.csv",
        "mounts.csv",
        "sharedFolders.csv",
        "certificates.csv",
        "sharingPreferences.csv",
        "launchD.csv",
        "usbDevices.csv",
        "managedPolicies.csv",
        "systemInfo.csv",
        "users.csv",
        "sipConfig.csv",
        "systemControls.csv",
        "canonical",
        "aliases",
        "custom_header_checks",
        "access",
        "bounce.cf.default",
        "generic",
        "header_checks",
        "main.cf.default",
        "LICENSE",
        "makedefs.out",
        "main.cf",
        "master.cf.default",
        "main.cf.proto",
        "master.cf.proto",
        "master.cf",
        "TLS_LICENSE",
        "postfix-files",
        "transport",
        "virtual",
        "relocated",
        "afpovertcp.cfg",
        "asl.conf",
        "auto_home",
        "auto_master",
        "autofs.conf",
        "bashrc_Apple_Terminal",
        "com.apple.screensharing.agent.launchd",
        "bashrc",
        "command_args.json",
        "csh.cshrc",
        "csh.login",
        "find.codes",
        "csh.logout",
        "ftpusers",
        "gettytab",
        "irbrc",
        "kern_loader.conf",
        "group",
        "locate.rc",
        "man.conf",
        "mail.rc",
        "manpaths",
        "networks",
        "nfs.conf",
        "newsyslog.conf",
        "ntp_opendirectory.conf",
        "ntp.conf",
        "notify.conf",
        "paths",
        "pf.conf",
        "passwd",
        "profile",
        "pf.os",
        "protocols",
        "rc.netboot",
        "rc.common",
        "rmtab",
        "resolv.conf",
        "rtadvd.conf",
        "rpc",
        "shells",
        "smb.conf",
        "sudo_lecture",
        "ttys",
        "syslog.conf",
        "xtab",
        "sudoers",
        "zprofile",
        "zshrc",
        "zshrc_Apple_Terminal",
        "CodeResources",
        "version.plist",
        "Info.plist"
      ],
      "public": 1,
      "adversary": "DragonForce Malaysia Hacker Group",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lastname",
          "display_name": "Lastname",
          "target": null
        },
        {
          "id": "Firstname",
          "display_name": "Firstname",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 66,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ilyailya",
        "id": "298851",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 4449,
        "domain": 3847,
        "URL": 14263,
        "FileHash-SHA256": 2356,
        "FileHash-MD5": 223,
        "FileHash-SHA1": 523,
        "email": 223,
        "CVE": 40,
        "CIDR": 12,
        "SSLCertFingerprint": 302
      },
      "indicator_count": 26238,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 35,
      "modified_text": "342 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f235b9a7a94a6a61acd651",
      "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
      "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
      "modified": "2025-03-07T08:38:08.584000",
      "created": "2024-09-24T03:44:57.902000",
      "tags": [
        "geoip",
        "public url",
        "as16509",
        "amazon02",
        "as20940",
        "akamaiasn1",
        "as8075",
        "as15169",
        "google",
        "akamaias",
        "facebook",
        "telecom",
        "twitter",
        "media",
        "win64",
        "level3",
        "mini",
        "ukraine",
        "proton",
        "ghost",
        "win32",
        "cuba",
        "mexico",
        "indonesia",
        "seznam",
        "as3359",
        "as852"
      ],
      "references": [
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
        "https://n0paste.eu/UH6n5pD/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Anguilla",
        "Poland",
        "Aruba",
        "Australia",
        "Barbados",
        "Costa Rica",
        "Guatemala",
        "Philippines",
        "Panama",
        "Sint Maarten (Dutch part)",
        "Saint Martin (French part)",
        "Cayman Islands",
        "Cura\u00e7ao",
        "Mexico",
        "Saint Vincent and the Grenadines",
        "Saint Kitts and Nevis",
        "Tanzania, United Republic of",
        "Netherlands",
        "Ukraine",
        "Trinidad and Tobago",
        "Japan",
        "Bahamas",
        "United Kingdom of Great Britain and Northern Ireland",
        "Georgia"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government",
        "Telecommunications",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1,
        "CIDR": 1186,
        "CVE": 4,
        "FileHash-MD5": 29,
        "FileHash-SHA1": 3,
        "URL": 25493,
        "domain": 5396,
        "email": 10,
        "hostname": 10770
      },
      "indicator_count": 42892,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 147,
      "modified_text": "408 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66b0fa3624bf0384e427f2e7",
      "name": "Tracking Domains 4.2 - 08.19.24",
      "description": "Tracking Domains detected by Privacy Badger Ext. on Microsoft Edge Browser (W11 Device) using Telus ISP (ASN852)\n*Not-Enriched (08.05.24): ~50,000 suggests IOCs by AlienVault\nFrom VT: 2 IPs hosted by 45090 (Shenzhen Tencent Computer Systems Company Limited) & 4611 (CNNIC member) seem to be the problem here 118[.]89.204.198, 118[.]89.0.0/16 & 202[.]123.107.15, 202[.]123.107.0/24 (Respectively)",
      "modified": "2024-09-04T15:01:01.432000",
      "created": "2024-08-05T16:13:42.563000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
        "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
        "https://viz.greynoise.io/query/AS4611",
        "https://urlscan.io/asn/AS4611",
        "https://urlscan.io/search/#asn:%22AS4611%22",
        "https://urlscan.io/asn/AS45090",
        "https://urlscan.io/search/#asn%3A%22AS45090%22",
        "https://viz.greynoise.io/query/AS45090",
        "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
        "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
        "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
        "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6180,
        "FileHash-MD5": 1,
        "domain": 24921,
        "URL": 10854
      },
      "indicator_count": 41956,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "592 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66269b1f33258a8e26033b17",
      "name": "Tracking Domains - Part 4.1",
      "description": "More Tracking Domains",
      "modified": "2024-08-30T13:02:28.335000",
      "created": "2024-04-22T17:15:11.398000",
      "tags": [
        "Tracking Domains"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
        "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark",
        "https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 94496,
        "FileHash-MD5": 63,
        "domain": 112327,
        "URL": 166918,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 103,
        "CIDR": 216
      },
      "indicator_count": 374156,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "597 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66269b204ecfba63974dc1d8",
      "name": "Tracking Domains - Part 4",
      "description": "More Tracking Domains",
      "modified": "2024-05-22T17:04:45.215000",
      "created": "2024-04-22T17:15:12.353000",
      "tags": [
        "Tracking Domains"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
        "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 792,
        "FileHash-MD5": 1,
        "domain": 5803,
        "URL": 2
      },
      "indicator_count": 6598,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 135,
      "modified_text": "697 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f152513c2dcc0f4e3406e",
      "name": "Threat Network Root & Distribution Vectors Probe",
      "description": "",
      "modified": "2023-10-30T02:29:57.489000",
      "created": "2023-10-30T02:29:57.489000",
      "tags": [
        "Domains",
        "ip addresses",
        "URLs",
        "Files",
        "Alberta Health Services",
        "BEC",
        "Education",
        "University of Alberta",
        "Government of Alberta",
        "Covenant Health Alberta",
        "Telus Communications",
        "Canadian Universities",
        "Malicious Certificates",
        "Digital Identity Theft / Credential Theft"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376",
        "https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783",
        "https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9",
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e",
        "https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328",
        "https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305",
        "https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98",
        "https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352",
        "https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary"
      ],
      "public": 1,
      "adversary": "Unknown APT Group(s) / Threat Actor (s)",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Philippines",
        "Panama",
        "Netherlands",
        "Anguilla",
        "Saint Vincent and the Grenadines",
        "Aruba",
        "Mexico",
        "Guatemala",
        "Costa Rica",
        "Tanzania, United Republic of"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "65133d6945641812c2ccc6ee",
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 230,
        "FileHash-SHA1": 139,
        "FileHash-SHA256": 1197,
        "URL": 9276,
        "CIDR": 16,
        "domain": 7895,
        "email": 2,
        "hostname": 1965
      },
      "indicator_count": 20720,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "902 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "impactserving.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "impactserving.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776620924.008846
}