{
  "type": "Domain",
  "indicator": "numantis.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/numantis.com",
    "alexa": "http://www.alexa.com/siteinfo/numantis.com",
    "indicator": "numantis.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3823517759,
      "indicator": "numantis.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "5cc01e4e17735e5d7c5887ec",
          "name": "Zeus - Malware Domain Feed V2",
          "description": "Command and Control domains for malware known as Zeus. These domains are extracted from malware sandbox reports using                             a Machine Learning model trained on a corpus of good and bad domains.",
          "modified": "2026-04-14T01:41:03.317000",
          "created": "2019-04-24T08:29:02.280000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 60,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "otxrobottwo",
            "id": "78495",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 123,
            "hostname": 4
          },
          "indicator_count": 127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1084,
          "modified_text": "5 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "5dad761b5597a507ee5c1c66",
          "name": "NjRat - Malware Domain Feed V2",
          "description": "Command and Control domains for malware known as NjRat. These domains are extracted from malware sandbox reports using                             a Machine Learning model trained on a corpus of good and bad domains.",
          "modified": "2026-03-08T03:31:32.826000",
          "created": "2019-10-21T09:10:51.154000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 178,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "otxrobottwo_testing",
            "id": "83138",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 845,
            "domain": 66
          },
          "indicator_count": 911,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 665,
          "modified_text": "42 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5e9f8cfc5fbc73142660",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:30:55.471000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5ea4d51d4a1cabdb4ee9",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:31:00.172000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66e6547f22d43d6d149cac7a",
          "name": "RedCap Abuse | The 1st Pulse was deleted from OTX . AlienVault",
          "description": "Another example of target working with a hacker impersonating some7he.sje was not. The hackers had the perfect opportunity to stay attached to Dropbox, photos. microphone and highlighted heavily targets location. || Target was suspicious about several issues related to pair. Hacker has only one piece of equipment for project. Target basically had to give him all , tips, cues and direction for project. If this Pulse is deleted I don't know what to think.",
          "modified": "2024-10-15T02:02:53.504000",
          "created": "2024-09-15T03:29:03.699000",
          "tags": [
            "urls",
            "passive dns",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "process32nextw",
            "intel",
            "ms windows",
            "united",
            "pe32",
            "search",
            "module load",
            "t1129",
            "read c",
            "default",
            "path",
            "write",
            "malware",
            "copy",
            "win32",
            "suspicious",
            "unknown",
            "united kingdom",
            "set cookie",
            "as43350 nforce",
            "script urls",
            "as55286",
            "status",
            "cookie",
            "trojan",
            "template",
            "showing",
            "entries",
            "body",
            "ransom",
            "meta",
            "a div",
            "div div",
            "ipv4",
            "script script",
            "as16276",
            "france unknown",
            "link",
            "span a",
            "span span",
            "span",
            "class",
            "pragma",
            "servers",
            "creation date",
            "emails",
            "domain",
            "expiration date",
            "cname",
            "aaaa",
            "certificate",
            "lowfitrojan",
            "hstr",
            "jsauto25 jun",
            "pm lowfitrojan",
            "related pulses",
            "file samples",
            "files matching",
            "show",
            "endpoints all",
            "trojan features",
            "date hash",
            "as15169 google",
            "as44273 host",
            "september",
            "de indicators",
            "domains",
            "hashes",
            "dynamicloader",
            "yara detections",
            "enigmaprotector",
            "high",
            "bios",
            "dynamic",
            "filehash",
            "yaxpax",
            "yapaxi",
            "zp6axi0",
            "cuckoo",
            "name servers",
            "domains ii",
            "for privacy",
            "redacted for",
            "next",
            "domain address",
            "alienvault name",
            "server",
            "flag",
            "contacted hosts",
            "process details",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "exit node",
            "traffic group",
            "suricata",
            "overview ip",
            "address",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "months ago",
            "created",
            "email",
            "modified",
            "filehashsha1",
            "filehashsha256",
            "white cve",
            "cyber",
            "xamzexpires300",
            "twitter",
            "xor ddos",
            "xorddos",
            "hacktool",
            "bazaarloader",
            "redcap",
            "formbook",
            "locky",
            "lockbit",
            "ransomware",
            "target",
            "ebury",
            "virustotal",
            "crypter",
            "shadowpad",
            "corrupt",
            "cryptor",
            "android",
            "xrat",
            "xtrat",
            "malicious",
            "honeypot",
            "fraud",
            "already",
            "behav",
            "ragnar locker",
            "swipper",
            "n\u2205 ip",
            "write c",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "delete c",
            "execution",
            "dock",
            "persistence",
            "august",
            "asnone bulgaria",
            "sales",
            "algorithm",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "whois lookups",
            "dnssec",
            "domain name",
            "abuse contact",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "date",
            "dns replication",
            "record type",
            "ttl value",
            "msms33388520",
            "data",
            "cus starizona",
            "cngo daddy",
            "authority",
            "g2 validity"
          ],
          "references": [
            "TrojanSpy:Win32/Nivdort.DE",
            "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn: FileHash-SHA256  00018d13f451300fb839123dfbf2d8607da0e7b1c89ae1bfbb9946ac79c1663c",
            "IDS Detections: Win32/Unruy Rogue Search Host Observed 1",
            "Yara Detections: Nrv2x ,  UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser",
            "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser",
            "Alerts: nids_malware_alert network_icmp persistence_autorun"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ransom:Win32/Haperlock",
              "display_name": "Ransom:Win32/Haperlock",
              "target": "/malware/Ransom:Win32/Haperlock"
            },
            {
              "id": "ALF:Trojan:Win32/Cassini_ade36583",
              "display_name": "ALF:Trojan:Win32/Cassini_ade36583",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
              "target": null
            },
            {
              "id": "Ransom:Win32/Wannaren",
              "display_name": "Ransom:Win32/Wannaren",
              "target": "/malware/Ransom:Win32/Wannaren"
            },
            {
              "id": "#LowfiTrojan:JS/Auto25",
              "display_name": "#LowfiTrojan:JS/Auto25",
              "target": "/malware/#LowfiTrojan:JS/Auto25"
            },
            {
              "id": "Trojan:Win32/Startpage",
              "display_name": "Trojan:Win32/Startpage",
              "target": "/malware/Trojan:Win32/Startpage"
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
              "target": null
            },
            {
              "id": "Win.Packed.XtremeRAT-9837419-0",
              "display_name": "Win.Packed.XtremeRAT-9837419-0",
              "target": null
            },
            {
              "id": "Win.Packed.Kelios-10023944-0",
              "display_name": "Win.Packed.Kelios-10023944-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Unruy-5885",
              "display_name": "Win.Trojan.Unruy-5885",
              "target": null
            },
            {
              "id": "Ebury",
              "display_name": "Ebury",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Swipper",
              "display_name": "Swipper",
              "target": null
            },
            {
              "id": "N\u2205 IP",
              "display_name": "N\u2205 IP",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.DE",
              "display_name": "TrojanSpy:Win32/Nivdort.DE",
              "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [
            "Government",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4315,
            "FileHash-MD5": 573,
            "FileHash-SHA1": 550,
            "FileHash-SHA256": 4114,
            "domain": 4757,
            "hostname": 2075,
            "SSLCertFingerprint": 5,
            "email": 14,
            "CIDR": 1
          },
          "indicator_count": 16404,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "551 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a4885e735b9e8ba94805bc",
          "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
          "description": "",
          "modified": "2024-09-05T06:51:42.608000",
          "created": "2024-01-15T01:20:30.730000",
          "tags": [
            "execution",
            "whois record",
            "contacted",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "copy",
            "historical ssl",
            "referrer",
            "urls url",
            "icmp",
            "malicious",
            "installer",
            "problems",
            "collections",
            "report",
            "phishing",
            "service tool",
            "greatness",
            "threat network",
            "emotet",
            "magniber",
            "startpage",
            "attack",
            "banker",
            "keylogger",
            "namecheap inc",
            "com laude",
            "ltd dba",
            "cloudflare",
            "porkbun llc",
            "ii llc",
            "csc corporate",
            "domains",
            "computer",
            "company limited",
            "first",
            "cloudflarenet",
            "google",
            "amazon02",
            "akamaias",
            "telecom italia",
            "utc submissions",
            "microsoftcorpas",
            "indonesia",
            "beijing gu",
            "appleaustin",
            "sucurisec",
            "amazonaes",
            "limited",
            "tsara brashears",
            "pornhub",
            "thebrotherssabey",
            "then brothers sabey",
            "brian sabey",
            "apple",
            "icloud",
            "apple engineering",
            "soc",
            "hacker",
            "teams",
            "malvertizing",
            "cyberthreat",
            "cyber crime",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "ecc domain",
            "server ca",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "remote",
            "remote attacker",
            "benjamin",
            "worm",
            "trojan",
            "win32",
            "trojanspy",
            "ransomware",
            "command and control",
            "cnc",
            "c2",
            "stealer",
            "password",
            "apple unlocker",
            "pornographers",
            "cyber stalking",
            "revenge rat",
            "masquerading",
            "scanning host",
            "phishing",
            "dns",
            "network",
            "cobalt strike",
            "mitre attack",
            "metro hacker",
            "t-mobile hacker",
            "stalker",
            "social engineering",
            "et",
            "torrent trecker",
            "view",
            "duckdns",
            "blackhat",
            "data center",
            "tracking",
            "illegal",
            "malware scripting",
            "malware spreader",
            "network rat",
            "multiple botnetworks"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/",
            "acam-mdn.apple.com",
            "beacons.bcp.gvt.com",
            "cpcontacts.webcamara.online",
            "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
            "http://ti.hicloudcam.com",
            "http://alohatube.xyz/search/tsara-brashears",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://search.app.goo.gl/?ofl",
            "Worm:Win32/Benjamin",
            "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
            "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
            "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
            "applemusic-spotlight.myunidays.com",
            "nr-data.net",
            "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
            "blackhat.store",
            "api.telegram.org",
            "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Silk",
              "display_name": "Silk",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65a429795adf468b427a3c8b",
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2469,
            "URL": 6038,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 157,
            "FileHash-SHA256": 3922,
            "CIDR": 2,
            "hostname": 2787,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 15547,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a7e576b3cbdf2f86a32acc",
          "name": "Skynet | prd.connectforhealthco.com | Identity theft |",
          "description": "Remote interception of health insurance applicants call.  Social engineering - threat actor will walk target through process beginning with; verification of phone model, browser used, phone number, email, ssn# entered in staged health insurance enrollment application. Auto forwards ssn#  to Experian, locking consumer from of all accounts, credit information is stolen, consumer identity theft. New accounts cannot be created, a password reset is required for scam, all emails requested,  bad actor will ask for entire households email accounts, device use, etc.  Sends malicious forms to devices. Takes consumer through a lengthy phone transfer scheme  +++",
          "modified": "2024-02-16T13:04:46.804000",
          "created": "2024-01-17T14:34:30.204000",
          "tags": [
            "whois record",
            "historical ssl",
            "ssl certificate",
            "april",
            "referrer",
            "threat roundup",
            "communicating",
            "whois",
            "rwi dtools",
            "jekyll",
            "metro",
            "skynet",
            "identity theft",
            "parking crew",
            "whois whois",
            "resolutions",
            "october",
            "august",
            "march",
            "june",
            "attack",
            "goldfinder",
            "sibot",
            "hacktool",
            "remote attack",
            "social engineering",
            "read c",
            "get autoit",
            "search",
            "regsetvalueexa",
            "show",
            "entries",
            "regdword",
            "intel",
            "ms windows",
            "showing",
            "autoit",
            "write",
            "worm",
            "copy",
            "unknown",
            "win32",
            "persistence",
            "execution",
            "malware",
            "autorun",
            "redacted for",
            "for privacy",
            "name servers",
            "date",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "pulse submit",
            "url analysis",
            "encrypt",
            "next",
            "sabey",
            "no expiration",
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "iocs",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "malware beacon",
            "useragent",
            "http request",
            "hostile",
            "autoit windows",
            "automation tool",
            "forbidden",
            "algorithm",
            "full name",
            "v3 serial",
            "number",
            "issuer",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "info",
            "first",
            "detections type",
            "name",
            "javascript",
            "pdf community",
            "office open",
            "xml spreadsheet",
            "text",
            "siblings",
            "process32nextw",
            "fjlsedauv",
            "writeconsolea",
            "medium",
            "discovery",
            "high",
            "module load",
            "t1129",
            "united",
            "as63949 linode",
            "mtb jan",
            "passive dns",
            "backdoor",
            "mtb dec",
            "open",
            "body",
            "artro",
            "creation date",
            "servers",
            "urls",
            "record value",
            "expiration date",
            "vt graph",
            "parent referrer",
            "apple private",
            "data collection",
            "hidden privacy",
            "malicious",
            "verified",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "tucows",
            "amazonaes",
            "china telecom",
            "group",
            "cloudflarenet",
            "akamaias",
            "pty ltd",
            "argon data",
            "communication",
            "limited",
            "digitaloceanasn",
            "twitter",
            "dropbox",
            "domainsite",
            "alibaba cloud",
            "computing",
            "beijing",
            "service",
            "ip address",
            "latest",
            "virustotal",
            "unclejohn",
            "us autonomous",
            "system46606",
            "unified layer",
            "urls latest",
            "contacted",
            "historical",
            "subdomains",
            "gootloader",
            "http response",
            "final url",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "binary",
            "sameorigin",
            "scammer",
            "spammer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "GoldFinder",
              "display_name": "GoldFinder",
              "target": null
            },
            {
              "id": "Sibot - S0589",
              "display_name": "Sibot - S0589",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
              "display_name": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
              "target": null
            },
            {
              "id": "W32/Expiro.fam",
              "display_name": "W32/Expiro.fam",
              "target": null
            },
            {
              "id": "Kimsuky",
              "display_name": "Kimsuky",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1460",
              "name": "Biometric Spoofing",
              "display_name": "T1460 - Biometric Spoofing"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            }
          ],
          "industries": [
            "Healthcare",
            "Insurance",
            "Finance",
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 515,
            "FileHash-SHA1": 504,
            "FileHash-SHA256": 3557,
            "URL": 5450,
            "domain": 1842,
            "hostname": 2221,
            "CVE": 2,
            "email": 6
          },
          "indicator_count": 14097,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "793 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a429795adf468b427a3c8b",
          "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
          "description": "Retaliation. Brian Sabey representing as an attorney and many other occupations contacted and socially engineered target. Uncertain of true name. Contacted 'alleged' SA assault victim. Made claims of representing a Jeffrey Scott Reimer DPT' alleged 'S' Assaulter.  Substantiated claims made with the twist of 'victim consented'. Mark Brian Sbabeys claims dismissed. Continues to hack, harass, intimidate target in every possible way. Hacking, monitoring, service, modification, phone contact, malicious texting, in person monitoring via colleagues, hacks into medical and medical billing centers, sells/leaks targets data on dark web.    Removed targets name from most pulses via  remote device access. Self whitelist. Everything he does is illegal.\n\nTarget not important enough to law enforcement.",
          "modified": "2024-02-13T17:04:19.437000",
          "created": "2024-01-14T18:35:37.757000",
          "tags": [
            "execution",
            "whois record",
            "contacted",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "copy",
            "historical ssl",
            "referrer",
            "urls url",
            "icmp",
            "malicious",
            "installer",
            "problems",
            "collections",
            "report",
            "phishing",
            "service tool",
            "greatness",
            "threat network",
            "emotet",
            "magniber",
            "startpage",
            "attack",
            "banker",
            "keylogger",
            "namecheap inc",
            "com laude",
            "ltd dba",
            "cloudflare",
            "porkbun llc",
            "ii llc",
            "csc corporate",
            "domains",
            "computer",
            "company limited",
            "first",
            "cloudflarenet",
            "google",
            "amazon02",
            "akamaias",
            "telecom italia",
            "utc submissions",
            "microsoftcorpas",
            "indonesia",
            "beijing gu",
            "appleaustin",
            "sucurisec",
            "amazonaes",
            "limited",
            "tsara brashears",
            "pornhub",
            "thebrotherssabey",
            "then brothers sabey",
            "brian sabey",
            "apple",
            "icloud",
            "apple engineering",
            "soc",
            "hacker",
            "teams",
            "malvertizing",
            "cyberthreat",
            "cyber crime",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "ecc domain",
            "server ca",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "remote",
            "remote attacker",
            "benjamin",
            "worm",
            "trojan",
            "win32",
            "trojanspy",
            "ransomware",
            "command and control",
            "cnc",
            "c2",
            "stealer",
            "password",
            "apple unlocker",
            "pornographers",
            "cyber stalking",
            "revenge rat",
            "masquerading",
            "scanning host",
            "phishing",
            "dns",
            "network",
            "cobalt strike",
            "mitre attack",
            "metro hacker",
            "t-mobile hacker",
            "stalker",
            "social engineering",
            "et",
            "torrent trecker",
            "view",
            "duckdns",
            "blackhat",
            "data center",
            "tracking",
            "illegal",
            "malware scripting",
            "malware spreader",
            "network rat",
            "multiple botnetworks"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/",
            "acam-mdn.apple.com",
            "beacons.bcp.gvt.com",
            "cpcontacts.webcamara.online",
            "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
            "http://ti.hicloudcam.com",
            "http://alohatube.xyz/search/tsara-brashears",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://search.app.goo.gl/?ofl",
            "Worm:Win32/Benjamin",
            "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
            "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
            "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
            "applemusic-spotlight.myunidays.com",
            "nr-data.net",
            "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
            "blackhat.store",
            "api.telegram.org",
            "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Silk",
              "display_name": "Silk",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2462,
            "URL": 5950,
            "FileHash-MD5": 168,
            "FileHash-SHA1": 156,
            "FileHash-SHA256": 3901,
            "CIDR": 2,
            "hostname": 2766,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 15408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IDS Detections: Win32/Unruy Rogue Search Host Observed 1",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "api.telegram.org",
        "applemusic-spotlight.myunidays.com",
        "blackhat.store",
        "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn: FileHash-SHA256  00018d13f451300fb839123dfbf2d8607da0e7b1c89ae1bfbb9946ac79c1663c",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "acam-mdn.apple.com",
        "https://search.app.goo.gl/?ofl",
        "http://api.jmtstudios.org/",
        "cpcontacts.webcamara.online",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "nr-data.net",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "https://thebrotherssabey.wordpress.com/",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser",
        "Worm:Win32/Benjamin",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "TrojanSpy:Win32/Nivdort.DE",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "Alerts: nids_malware_alert network_icmp persistence_autorun",
        "bricked.wtf",
        "Yara Detections: Nrv2x ,  UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser",
        "http://ti.hicloudcam.com",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "beacons.bcp.gvt.com",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party.",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.jmtstudios.org/farewell/",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.packed.kelios-10023944-0",
            "Kimsuky",
            "Worm:win32/benjamin",
            "Alf:trojan:win32/cassini_ade36583",
            "Locky",
            "Artro",
            "Win.malware.convagent-9981433-0",
            "Verified",
            "Tulach",
            "#lowfi:siga:trojanspy:msil/keylogger",
            "N\u2205 ip",
            "Ransom:win32/wannaren",
            "Swipper",
            "Formbook",
            "W32/expiro.fam",
            "Upadter",
            "Sibot - s0589",
            "Ebury",
            "Silk",
            "Emotet",
            "Ransom:win32/haperlock",
            "Alf:heraklezeval:trojandownloader:win32/unruy!rfn",
            "Mydoom",
            "Alf:heraklezeval:trojandownloader:win32/unruy",
            "Trojanspy:win32/nivdort.de",
            "Win.trojan.unruy-5885",
            "Hacktool",
            "Win.packed.xtremerat-9837419-0",
            "#lowfitrojan:js/auto25",
            "Skynet",
            "Downloader.cerber/js!1.a59c (classic)",
            "Sabey",
            "Goldfinder",
            "Trojan:win32/startpage"
          ],
          "industries": [
            "Government",
            "Technology",
            "Healthcare",
            "Insurance",
            "Finance",
            "Telecommunications"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "5cc01e4e17735e5d7c5887ec",
      "name": "Zeus - Malware Domain Feed V2",
      "description": "Command and Control domains for malware known as Zeus. These domains are extracted from malware sandbox reports using                             a Machine Learning model trained on a corpus of good and bad domains.",
      "modified": "2026-04-14T01:41:03.317000",
      "created": "2019-04-24T08:29:02.280000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 60,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "otxrobottwo",
        "id": "78495",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 123,
        "hostname": 4
      },
      "indicator_count": 127,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1084,
      "modified_text": "5 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "5dad761b5597a507ee5c1c66",
      "name": "NjRat - Malware Domain Feed V2",
      "description": "Command and Control domains for malware known as NjRat. These domains are extracted from malware sandbox reports using                             a Machine Learning model trained on a corpus of good and bad domains.",
      "modified": "2026-03-08T03:31:32.826000",
      "created": "2019-10-21T09:10:51.154000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 178,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "otxrobottwo_testing",
        "id": "83138",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 845,
        "domain": 66
      },
      "indicator_count": 911,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 665,
      "modified_text": "42 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5e9f8cfc5fbc73142660",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:30:55.471000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5ea4d51d4a1cabdb4ee9",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:31:00.172000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66e6547f22d43d6d149cac7a",
      "name": "RedCap Abuse | The 1st Pulse was deleted from OTX . AlienVault",
      "description": "Another example of target working with a hacker impersonating some7he.sje was not. The hackers had the perfect opportunity to stay attached to Dropbox, photos. microphone and highlighted heavily targets location. || Target was suspicious about several issues related to pair. Hacker has only one piece of equipment for project. Target basically had to give him all , tips, cues and direction for project. If this Pulse is deleted I don't know what to think.",
      "modified": "2024-10-15T02:02:53.504000",
      "created": "2024-09-15T03:29:03.699000",
      "tags": [
        "urls",
        "passive dns",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "process32nextw",
        "intel",
        "ms windows",
        "united",
        "pe32",
        "search",
        "module load",
        "t1129",
        "read c",
        "default",
        "path",
        "write",
        "malware",
        "copy",
        "win32",
        "suspicious",
        "unknown",
        "united kingdom",
        "set cookie",
        "as43350 nforce",
        "script urls",
        "as55286",
        "status",
        "cookie",
        "trojan",
        "template",
        "showing",
        "entries",
        "body",
        "ransom",
        "meta",
        "a div",
        "div div",
        "ipv4",
        "script script",
        "as16276",
        "france unknown",
        "link",
        "span a",
        "span span",
        "span",
        "class",
        "pragma",
        "servers",
        "creation date",
        "emails",
        "domain",
        "expiration date",
        "cname",
        "aaaa",
        "certificate",
        "lowfitrojan",
        "hstr",
        "jsauto25 jun",
        "pm lowfitrojan",
        "related pulses",
        "file samples",
        "files matching",
        "show",
        "endpoints all",
        "trojan features",
        "date hash",
        "as15169 google",
        "as44273 host",
        "september",
        "de indicators",
        "domains",
        "hashes",
        "dynamicloader",
        "yara detections",
        "enigmaprotector",
        "high",
        "bios",
        "dynamic",
        "filehash",
        "yaxpax",
        "yapaxi",
        "zp6axi0",
        "cuckoo",
        "name servers",
        "domains ii",
        "for privacy",
        "redacted for",
        "next",
        "domain address",
        "alienvault name",
        "server",
        "flag",
        "contacted hosts",
        "process details",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "exit node",
        "traffic group",
        "suricata",
        "overview ip",
        "address",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "months ago",
        "created",
        "email",
        "modified",
        "filehashsha1",
        "filehashsha256",
        "white cve",
        "cyber",
        "xamzexpires300",
        "twitter",
        "xor ddos",
        "xorddos",
        "hacktool",
        "bazaarloader",
        "redcap",
        "formbook",
        "locky",
        "lockbit",
        "ransomware",
        "target",
        "ebury",
        "virustotal",
        "crypter",
        "shadowpad",
        "corrupt",
        "cryptor",
        "android",
        "xrat",
        "xtrat",
        "malicious",
        "honeypot",
        "fraud",
        "already",
        "behav",
        "ragnar locker",
        "swipper",
        "n\u2205 ip",
        "write c",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "delete c",
        "execution",
        "dock",
        "persistence",
        "august",
        "asnone bulgaria",
        "sales",
        "algorithm",
        "v3 serial",
        "number",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "first",
        "whois lookups",
        "dnssec",
        "domain name",
        "abuse contact",
        "registrar abuse",
        "contact phone",
        "registrar iana",
        "date",
        "dns replication",
        "record type",
        "ttl value",
        "msms33388520",
        "data",
        "cus starizona",
        "cngo daddy",
        "authority",
        "g2 validity"
      ],
      "references": [
        "TrojanSpy:Win32/Nivdort.DE",
        "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn: FileHash-SHA256  00018d13f451300fb839123dfbf2d8607da0e7b1c89ae1bfbb9946ac79c1663c",
        "IDS Detections: Win32/Unruy Rogue Search Host Observed 1",
        "Yara Detections: Nrv2x ,  UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser",
        "Alerts: nids_malware_alert network_icmp persistence_autorun"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ransom:Win32/Haperlock",
          "display_name": "Ransom:Win32/Haperlock",
          "target": "/malware/Ransom:Win32/Haperlock"
        },
        {
          "id": "ALF:Trojan:Win32/Cassini_ade36583",
          "display_name": "ALF:Trojan:Win32/Cassini_ade36583",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
          "target": null
        },
        {
          "id": "Ransom:Win32/Wannaren",
          "display_name": "Ransom:Win32/Wannaren",
          "target": "/malware/Ransom:Win32/Wannaren"
        },
        {
          "id": "#LowfiTrojan:JS/Auto25",
          "display_name": "#LowfiTrojan:JS/Auto25",
          "target": "/malware/#LowfiTrojan:JS/Auto25"
        },
        {
          "id": "Trojan:Win32/Startpage",
          "display_name": "Trojan:Win32/Startpage",
          "target": "/malware/Trojan:Win32/Startpage"
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
          "target": null
        },
        {
          "id": "Win.Packed.XtremeRAT-9837419-0",
          "display_name": "Win.Packed.XtremeRAT-9837419-0",
          "target": null
        },
        {
          "id": "Win.Packed.Kelios-10023944-0",
          "display_name": "Win.Packed.Kelios-10023944-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Unruy-5885",
          "display_name": "Win.Trojan.Unruy-5885",
          "target": null
        },
        {
          "id": "Ebury",
          "display_name": "Ebury",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Swipper",
          "display_name": "Swipper",
          "target": null
        },
        {
          "id": "N\u2205 IP",
          "display_name": "N\u2205 IP",
          "target": null
        },
        {
          "id": "Locky",
          "display_name": "Locky",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.DE",
          "display_name": "TrojanSpy:Win32/Nivdort.DE",
          "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [
        "Government",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4315,
        "FileHash-MD5": 573,
        "FileHash-SHA1": 550,
        "FileHash-SHA256": 4114,
        "domain": 4757,
        "hostname": 2075,
        "SSLCertFingerprint": 5,
        "email": 14,
        "CIDR": 1
      },
      "indicator_count": 16404,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "551 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a4885e735b9e8ba94805bc",
      "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
      "description": "",
      "modified": "2024-09-05T06:51:42.608000",
      "created": "2024-01-15T01:20:30.730000",
      "tags": [
        "execution",
        "whois record",
        "contacted",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "copy",
        "historical ssl",
        "referrer",
        "urls url",
        "icmp",
        "malicious",
        "installer",
        "problems",
        "collections",
        "report",
        "phishing",
        "service tool",
        "greatness",
        "threat network",
        "emotet",
        "magniber",
        "startpage",
        "attack",
        "banker",
        "keylogger",
        "namecheap inc",
        "com laude",
        "ltd dba",
        "cloudflare",
        "porkbun llc",
        "ii llc",
        "csc corporate",
        "domains",
        "computer",
        "company limited",
        "first",
        "cloudflarenet",
        "google",
        "amazon02",
        "akamaias",
        "telecom italia",
        "utc submissions",
        "microsoftcorpas",
        "indonesia",
        "beijing gu",
        "appleaustin",
        "sucurisec",
        "amazonaes",
        "limited",
        "tsara brashears",
        "pornhub",
        "thebrotherssabey",
        "then brothers sabey",
        "brian sabey",
        "apple",
        "icloud",
        "apple engineering",
        "soc",
        "hacker",
        "teams",
        "malvertizing",
        "cyberthreat",
        "cyber crime",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "ecc domain",
        "server ca",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "remote",
        "remote attacker",
        "benjamin",
        "worm",
        "trojan",
        "win32",
        "trojanspy",
        "ransomware",
        "command and control",
        "cnc",
        "c2",
        "stealer",
        "password",
        "apple unlocker",
        "pornographers",
        "cyber stalking",
        "revenge rat",
        "masquerading",
        "scanning host",
        "phishing",
        "dns",
        "network",
        "cobalt strike",
        "mitre attack",
        "metro hacker",
        "t-mobile hacker",
        "stalker",
        "social engineering",
        "et",
        "torrent trecker",
        "view",
        "duckdns",
        "blackhat",
        "data center",
        "tracking",
        "illegal",
        "malware scripting",
        "malware spreader",
        "network rat",
        "multiple botnetworks"
      ],
      "references": [
        "https://thebrotherssabey.wordpress.com/",
        "acam-mdn.apple.com",
        "beacons.bcp.gvt.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "http://ti.hicloudcam.com",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://search.app.goo.gl/?ofl",
        "Worm:Win32/Benjamin",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "applemusic-spotlight.myunidays.com",
        "nr-data.net",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "blackhat.store",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Silk",
          "display_name": "Silk",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65a429795adf468b427a3c8b",
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2469,
        "URL": 6038,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 157,
        "FileHash-SHA256": 3922,
        "CIDR": 2,
        "hostname": 2787,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 15547,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a7e576b3cbdf2f86a32acc",
      "name": "Skynet | prd.connectforhealthco.com | Identity theft |",
      "description": "Remote interception of health insurance applicants call.  Social engineering - threat actor will walk target through process beginning with; verification of phone model, browser used, phone number, email, ssn# entered in staged health insurance enrollment application. Auto forwards ssn#  to Experian, locking consumer from of all accounts, credit information is stolen, consumer identity theft. New accounts cannot be created, a password reset is required for scam, all emails requested,  bad actor will ask for entire households email accounts, device use, etc.  Sends malicious forms to devices. Takes consumer through a lengthy phone transfer scheme  +++",
      "modified": "2024-02-16T13:04:46.804000",
      "created": "2024-01-17T14:34:30.204000",
      "tags": [
        "whois record",
        "historical ssl",
        "ssl certificate",
        "april",
        "referrer",
        "threat roundup",
        "communicating",
        "whois",
        "rwi dtools",
        "jekyll",
        "metro",
        "skynet",
        "identity theft",
        "parking crew",
        "whois whois",
        "resolutions",
        "october",
        "august",
        "march",
        "june",
        "attack",
        "goldfinder",
        "sibot",
        "hacktool",
        "remote attack",
        "social engineering",
        "read c",
        "get autoit",
        "search",
        "regsetvalueexa",
        "show",
        "entries",
        "regdword",
        "intel",
        "ms windows",
        "showing",
        "autoit",
        "write",
        "worm",
        "copy",
        "unknown",
        "win32",
        "persistence",
        "execution",
        "malware",
        "autorun",
        "redacted for",
        "for privacy",
        "name servers",
        "date",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "pulse submit",
        "url analysis",
        "encrypt",
        "next",
        "sabey",
        "no expiration",
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "iocs",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "malware beacon",
        "useragent",
        "http request",
        "hostile",
        "autoit windows",
        "automation tool",
        "forbidden",
        "algorithm",
        "full name",
        "v3 serial",
        "number",
        "issuer",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "info",
        "first",
        "detections type",
        "name",
        "javascript",
        "pdf community",
        "office open",
        "xml spreadsheet",
        "text",
        "siblings",
        "process32nextw",
        "fjlsedauv",
        "writeconsolea",
        "medium",
        "discovery",
        "high",
        "module load",
        "t1129",
        "united",
        "as63949 linode",
        "mtb jan",
        "passive dns",
        "backdoor",
        "mtb dec",
        "open",
        "body",
        "artro",
        "creation date",
        "servers",
        "urls",
        "record value",
        "expiration date",
        "vt graph",
        "parent referrer",
        "apple private",
        "data collection",
        "hidden privacy",
        "malicious",
        "verified",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "tucows",
        "amazonaes",
        "china telecom",
        "group",
        "cloudflarenet",
        "akamaias",
        "pty ltd",
        "argon data",
        "communication",
        "limited",
        "digitaloceanasn",
        "twitter",
        "dropbox",
        "domainsite",
        "alibaba cloud",
        "computing",
        "beijing",
        "service",
        "ip address",
        "latest",
        "virustotal",
        "unclejohn",
        "us autonomous",
        "system46606",
        "unified layer",
        "urls latest",
        "contacted",
        "historical",
        "subdomains",
        "gootloader",
        "http response",
        "final url",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "binary",
        "sameorigin",
        "scammer",
        "spammer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        },
        {
          "id": "GoldFinder",
          "display_name": "GoldFinder",
          "target": null
        },
        {
          "id": "Sibot - S0589",
          "display_name": "Sibot - S0589",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Verified",
          "display_name": "Verified",
          "target": null
        },
        {
          "id": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
          "display_name": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
          "target": null
        },
        {
          "id": "W32/Expiro.fam",
          "display_name": "W32/Expiro.fam",
          "target": null
        },
        {
          "id": "Kimsuky",
          "display_name": "Kimsuky",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1460",
          "name": "Biometric Spoofing",
          "display_name": "T1460 - Biometric Spoofing"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        }
      ],
      "industries": [
        "Healthcare",
        "Insurance",
        "Finance",
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 515,
        "FileHash-SHA1": 504,
        "FileHash-SHA256": 3557,
        "URL": 5450,
        "domain": 1842,
        "hostname": 2221,
        "CVE": 2,
        "email": 6
      },
      "indicator_count": 14097,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "793 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a429795adf468b427a3c8b",
      "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
      "description": "Retaliation. Brian Sabey representing as an attorney and many other occupations contacted and socially engineered target. Uncertain of true name. Contacted 'alleged' SA assault victim. Made claims of representing a Jeffrey Scott Reimer DPT' alleged 'S' Assaulter.  Substantiated claims made with the twist of 'victim consented'. Mark Brian Sbabeys claims dismissed. Continues to hack, harass, intimidate target in every possible way. Hacking, monitoring, service, modification, phone contact, malicious texting, in person monitoring via colleagues, hacks into medical and medical billing centers, sells/leaks targets data on dark web.    Removed targets name from most pulses via  remote device access. Self whitelist. Everything he does is illegal.\n\nTarget not important enough to law enforcement.",
      "modified": "2024-02-13T17:04:19.437000",
      "created": "2024-01-14T18:35:37.757000",
      "tags": [
        "execution",
        "whois record",
        "contacted",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "copy",
        "historical ssl",
        "referrer",
        "urls url",
        "icmp",
        "malicious",
        "installer",
        "problems",
        "collections",
        "report",
        "phishing",
        "service tool",
        "greatness",
        "threat network",
        "emotet",
        "magniber",
        "startpage",
        "attack",
        "banker",
        "keylogger",
        "namecheap inc",
        "com laude",
        "ltd dba",
        "cloudflare",
        "porkbun llc",
        "ii llc",
        "csc corporate",
        "domains",
        "computer",
        "company limited",
        "first",
        "cloudflarenet",
        "google",
        "amazon02",
        "akamaias",
        "telecom italia",
        "utc submissions",
        "microsoftcorpas",
        "indonesia",
        "beijing gu",
        "appleaustin",
        "sucurisec",
        "amazonaes",
        "limited",
        "tsara brashears",
        "pornhub",
        "thebrotherssabey",
        "then brothers sabey",
        "brian sabey",
        "apple",
        "icloud",
        "apple engineering",
        "soc",
        "hacker",
        "teams",
        "malvertizing",
        "cyberthreat",
        "cyber crime",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "ecc domain",
        "server ca",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "remote",
        "remote attacker",
        "benjamin",
        "worm",
        "trojan",
        "win32",
        "trojanspy",
        "ransomware",
        "command and control",
        "cnc",
        "c2",
        "stealer",
        "password",
        "apple unlocker",
        "pornographers",
        "cyber stalking",
        "revenge rat",
        "masquerading",
        "scanning host",
        "phishing",
        "dns",
        "network",
        "cobalt strike",
        "mitre attack",
        "metro hacker",
        "t-mobile hacker",
        "stalker",
        "social engineering",
        "et",
        "torrent trecker",
        "view",
        "duckdns",
        "blackhat",
        "data center",
        "tracking",
        "illegal",
        "malware scripting",
        "malware spreader",
        "network rat",
        "multiple botnetworks"
      ],
      "references": [
        "https://thebrotherssabey.wordpress.com/",
        "acam-mdn.apple.com",
        "beacons.bcp.gvt.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "http://ti.hicloudcam.com",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://search.app.goo.gl/?ofl",
        "Worm:Win32/Benjamin",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "applemusic-spotlight.myunidays.com",
        "nr-data.net",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "blackhat.store",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Silk",
          "display_name": "Silk",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2462,
        "URL": 5950,
        "FileHash-MD5": 168,
        "FileHash-SHA1": 156,
        "FileHash-SHA256": 3901,
        "CIDR": 2,
        "hostname": 2766,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 15408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "numantis.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "numantis.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776616962.6770356
}