{
  "type": "Domain",
  "indicator": "secdeck.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/secdeck.com",
    "alexa": "http://www.alexa.com/siteinfo/secdeck.com",
    "indicator": "secdeck.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2779212856,
      "indicator": "secdeck.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6a056cacb981e6f3b2dd4647",
          "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
          "description": "",
          "modified": "2026-05-14T07:28:01.780000",
          "created": "2026-05-14T06:33:16.946000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb3ef6d765187a437767e4",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1521,
            "FileHash-SHA1": 1395,
            "FileHash-SHA256": 6084,
            "URL": 1499,
            "domain": 1947,
            "hostname": 1361,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13826,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "17 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a056cac80d9b80eb1a97e29",
          "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
          "description": "",
          "modified": "2026-05-14T07:14:09.098000",
          "created": "2026-05-14T06:33:16.505000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb3ef6d765187a437767e4",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1493,
            "FileHash-SHA1": 1393,
            "FileHash-SHA256": 5881,
            "URL": 1499,
            "domain": 1947,
            "hostname": 1360,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13592,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "17 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb3ef6d765187a437767e4",
          "name": "Hijacked 'Operation Endgame' Tofsee  Ransomware",
          "description": "This a project. A target has been put into  different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT  get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click'  document.. Faldif0, empty docmpty doc, citing  it was refreshed in 2023. \nThere is no doubt these  masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely.  Attack is disseminates from USA.",
          "modified": "2024-10-18T20:04:41.836000",
          "created": "2024-09-18T20:58:30.691000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1493,
            "FileHash-SHA1": 1393,
            "FileHash-SHA256": 5881,
            "URL": 1495,
            "domain": 1947,
            "hostname": 1360,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13588,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "590 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eb9d9426d9822cf0895b91",
          "name": "Australia Immortal | Ponmicup | Beach Research  (modified by unknown)",
          "description": "",
          "modified": "2024-03-08T23:21:56.652000",
          "created": "2024-03-08T23:21:56.652000",
          "tags": [
            "url https",
            "url http",
            "months ago",
            "michael roberts",
            "scan endpoints",
            "all milesit",
            "octoseek report",
            "spam author",
            "modified",
            "handle",
            "next",
            "returnurl",
            "potential",
            "ipv4",
            "rexxfield",
            "cyber threat",
            "united",
            "malicious",
            "team phishing",
            "hostname",
            "malware site",
            "coalition",
            "control server",
            "covid19",
            "malicious site",
            "malware",
            "team",
            "phishing",
            "virustotal",
            "bank",
            "facebook",
            "plasma",
            "kraken",
            "redline stealer",
            "citadel",
            "zeus",
            "ransomware",
            "zbot",
            "emotet",
            "simda",
            "pykspa",
            "inmortal",
            "domains",
            "detection list",
            "blacklist",
            "generic malware",
            "blacklist https",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "ponmocup",
            "tsara brashears",
            "name verdict",
            "falcon sandbox",
            "et cins",
            "active threat",
            "reputation ip",
            "relay",
            "malicious host",
            "ice fog",
            "mail spammer",
            "brute force",
            "as11404",
            "first",
            "phishing site",
            "malicious url",
            "heur",
            "riskware",
            "agent",
            "unsafe",
            "download",
            "opencandy",
            "exploit",
            "mimikatz",
            "quasar rat",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "azorult",
            "service",
            "runescape",
            "union",
            "beach research",
            "drones",
            "miles2",
            "songculture attacked",
            "phishing",
            "monitoring",
            "mailtrak",
            "tracking",
            "geoapy",
            "location tracking",
            "obsession"
          ],
          "references": [],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "Domains",
              "display_name": "Domains",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65418472eb20b10ee5510fde",
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3121,
            "domain": 1121,
            "hostname": 972,
            "FileHash-SHA256": 564,
            "email": 2,
            "CVE": 4,
            "FileHash-MD5": 74,
            "FileHash-SHA1": 39
          },
          "indicator_count": 5897,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "813 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65418472eb20b10ee5510fde",
          "name": "Australia Immortal | Ponmicup | Beach Research",
          "description": "Okay, Michael Roberts of Rexxfield[.]com is an alleged cyber security hacker, victim, adversary, etc. As far as I  go back he is attached defacement. Mr. SQL. Allegedly works for attorneys. Cover up guy. I don't know if he is real despite the incredible stories online from capturing a murderer to being married to one. Based on what I've read he avenges medical professionals who commit crimes by attacking and silencing and his favorite injection. I was looking at device, a remote video from MILESIT.COM covered entire screen. (Auto populated: The results of an analysis of more than 400,000 IP addresses found on the OpenPhish website, compiled by the Phishing Research Team, have been published on Facebook, Twitter and Facebook.)",
          "modified": "2023-11-30T22:00:36.762000",
          "created": "2023-10-31T22:49:22.495000",
          "tags": [
            "url https",
            "url http",
            "months ago",
            "michael roberts",
            "scan endpoints",
            "all milesit",
            "octoseek report",
            "spam author",
            "modified",
            "handle",
            "next",
            "returnurl",
            "potential",
            "ipv4",
            "rexxfield",
            "cyber threat",
            "united",
            "malicious",
            "team phishing",
            "hostname",
            "malware site",
            "coalition",
            "control server",
            "covid19",
            "malicious site",
            "malware",
            "team",
            "phishing",
            "virustotal",
            "bank",
            "facebook",
            "plasma",
            "kraken",
            "redline stealer",
            "citadel",
            "zeus",
            "ransomware",
            "zbot",
            "emotet",
            "simda",
            "pykspa",
            "inmortal",
            "domains",
            "detection list",
            "blacklist",
            "generic malware",
            "blacklist https",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "ponmocup",
            "tsara brashears",
            "name verdict",
            "falcon sandbox",
            "et cins",
            "active threat",
            "reputation ip",
            "relay",
            "malicious host",
            "ice fog",
            "mail spammer",
            "brute force",
            "as11404",
            "first",
            "phishing site",
            "malicious url",
            "heur",
            "riskware",
            "agent",
            "unsafe",
            "download",
            "opencandy",
            "exploit",
            "mimikatz",
            "quasar rat",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "azorult",
            "service",
            "runescape",
            "union",
            "beach research",
            "drones",
            "miles2",
            "songculture attacked",
            "phishing",
            "monitoring",
            "mailtrak",
            "tracking",
            "geoapy",
            "location tracking",
            "obsession"
          ],
          "references": [],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "Domains",
              "display_name": "Domains",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 50,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3121,
            "domain": 1121,
            "hostname": 972,
            "FileHash-SHA256": 564,
            "email": 2,
            "CVE": 4,
            "FileHash-MD5": 74,
            "FileHash-SHA1": 39
          },
          "indicator_count": 5897,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6544cc36799d1c45c82c1ed7",
          "name": "Australia Immortal | Ponmicup | Beach Research",
          "description": "",
          "modified": "2023-11-30T22:00:36.762000",
          "created": "2023-11-03T10:32:22.249000",
          "tags": [
            "url https",
            "url http",
            "months ago",
            "michael roberts",
            "scan endpoints",
            "all milesit",
            "octoseek report",
            "spam author",
            "modified",
            "handle",
            "next",
            "returnurl",
            "potential",
            "ipv4",
            "rexxfield",
            "cyber threat",
            "united",
            "malicious",
            "team phishing",
            "hostname",
            "malware site",
            "coalition",
            "control server",
            "covid19",
            "malicious site",
            "malware",
            "team",
            "phishing",
            "virustotal",
            "bank",
            "facebook",
            "plasma",
            "kraken",
            "redline stealer",
            "citadel",
            "zeus",
            "ransomware",
            "zbot",
            "emotet",
            "simda",
            "pykspa",
            "inmortal",
            "domains",
            "detection list",
            "blacklist",
            "generic malware",
            "blacklist https",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "ponmocup",
            "tsara brashears",
            "name verdict",
            "falcon sandbox",
            "et cins",
            "active threat",
            "reputation ip",
            "relay",
            "malicious host",
            "ice fog",
            "mail spammer",
            "brute force",
            "as11404",
            "first",
            "phishing site",
            "malicious url",
            "heur",
            "riskware",
            "agent",
            "unsafe",
            "download",
            "opencandy",
            "exploit",
            "mimikatz",
            "quasar rat",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "azorult",
            "service",
            "runescape",
            "union",
            "beach research",
            "drones",
            "miles2",
            "songculture attacked",
            "phishing",
            "monitoring",
            "mailtrak",
            "tracking",
            "geoapy",
            "location tracking",
            "obsession"
          ],
          "references": [],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "Domains",
              "display_name": "Domains",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65418472eb20b10ee5510fde",
          "export_count": 53,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3121,
            "domain": 1121,
            "hostname": 972,
            "FileHash-SHA256": 564,
            "email": 2,
            "CVE": 4,
            "FileHash-MD5": 74,
            "FileHash-SHA1": 39
          },
          "indicator_count": 5897,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65459d8355ffcc57175db685",
          "name": "Australia Immortal | Ponmicup | Beach Research",
          "description": "",
          "modified": "2023-11-30T22:00:36.762000",
          "created": "2023-11-04T01:25:23.996000",
          "tags": [
            "url https",
            "url http",
            "months ago",
            "michael roberts",
            "scan endpoints",
            "all milesit",
            "octoseek report",
            "spam author",
            "modified",
            "handle",
            "next",
            "returnurl",
            "potential",
            "ipv4",
            "rexxfield",
            "cyber threat",
            "united",
            "malicious",
            "team phishing",
            "hostname",
            "malware site",
            "coalition",
            "control server",
            "covid19",
            "malicious site",
            "malware",
            "team",
            "phishing",
            "virustotal",
            "bank",
            "facebook",
            "plasma",
            "kraken",
            "redline stealer",
            "citadel",
            "zeus",
            "ransomware",
            "zbot",
            "emotet",
            "simda",
            "pykspa",
            "inmortal",
            "domains",
            "detection list",
            "blacklist",
            "generic malware",
            "blacklist https",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "ponmocup",
            "tsara brashears",
            "name verdict",
            "falcon sandbox",
            "et cins",
            "active threat",
            "reputation ip",
            "relay",
            "malicious host",
            "ice fog",
            "mail spammer",
            "brute force",
            "as11404",
            "first",
            "phishing site",
            "malicious url",
            "heur",
            "riskware",
            "agent",
            "unsafe",
            "download",
            "opencandy",
            "exploit",
            "mimikatz",
            "quasar rat",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "azorult",
            "service",
            "runescape",
            "union",
            "beach research",
            "drones",
            "miles2",
            "songculture attacked",
            "phishing",
            "monitoring",
            "mailtrak",
            "tracking",
            "geoapy",
            "location tracking",
            "obsession"
          ],
          "references": [],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "Domains",
              "display_name": "Domains",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6544cc36799d1c45c82c1ed7",
          "export_count": 49,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3121,
            "domain": 1121,
            "hostname": 972,
            "FileHash-SHA256": 564,
            "email": 2,
            "CVE": 4,
            "FileHash-MD5": 74,
            "FileHash-SHA1": 39
          },
          "indicator_count": 5897,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "[Unnamed group]"
          ],
          "malware_families": [
            "Worm:win32/macoute.a",
            "Tofsee",
            "Mal/generic-s",
            "Inmortal",
            "Domains",
            "Trojandownloader:win32/nemucod",
            "Cryp_xed-12",
            "Ransom:win32/eniqma.a",
            "Beach research",
            "Trojanspy:win32/nivdort",
            "Worm:win32/fesber.a",
            "Alf:heraklezeval:rogue:win32/fakerean",
            "Upackv037dwing"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6a056cacb981e6f3b2dd4647",
      "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
      "description": "",
      "modified": "2026-05-14T07:28:01.780000",
      "created": "2026-05-14T06:33:16.946000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb3ef6d765187a437767e4",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1521,
        "FileHash-SHA1": 1395,
        "FileHash-SHA256": 6084,
        "URL": 1499,
        "domain": 1947,
        "hostname": 1361,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13826,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "17 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a056cac80d9b80eb1a97e29",
      "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
      "description": "",
      "modified": "2026-05-14T07:14:09.098000",
      "created": "2026-05-14T06:33:16.505000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb3ef6d765187a437767e4",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1493,
        "FileHash-SHA1": 1393,
        "FileHash-SHA256": 5881,
        "URL": 1499,
        "domain": 1947,
        "hostname": 1360,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13592,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "17 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66eb3ef6d765187a437767e4",
      "name": "Hijacked 'Operation Endgame' Tofsee  Ransomware",
      "description": "This a project. A target has been put into  different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT  get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click'  document.. Faldif0, empty docmpty doc, citing  it was refreshed in 2023. \nThere is no doubt these  masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely.  Attack is disseminates from USA.",
      "modified": "2024-10-18T20:04:41.836000",
      "created": "2024-09-18T20:58:30.691000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1493,
        "FileHash-SHA1": 1393,
        "FileHash-SHA256": 5881,
        "URL": 1495,
        "domain": 1947,
        "hostname": 1360,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13588,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "590 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65eb9d9426d9822cf0895b91",
      "name": "Australia Immortal | Ponmicup | Beach Research  (modified by unknown)",
      "description": "",
      "modified": "2024-03-08T23:21:56.652000",
      "created": "2024-03-08T23:21:56.652000",
      "tags": [
        "url https",
        "url http",
        "months ago",
        "michael roberts",
        "scan endpoints",
        "all milesit",
        "octoseek report",
        "spam author",
        "modified",
        "handle",
        "next",
        "returnurl",
        "potential",
        "ipv4",
        "rexxfield",
        "cyber threat",
        "united",
        "malicious",
        "team phishing",
        "hostname",
        "malware site",
        "coalition",
        "control server",
        "covid19",
        "malicious site",
        "malware",
        "team",
        "phishing",
        "virustotal",
        "bank",
        "facebook",
        "plasma",
        "kraken",
        "redline stealer",
        "citadel",
        "zeus",
        "ransomware",
        "zbot",
        "emotet",
        "simda",
        "pykspa",
        "inmortal",
        "domains",
        "detection list",
        "blacklist",
        "generic malware",
        "blacklist https",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "ponmocup",
        "tsara brashears",
        "name verdict",
        "falcon sandbox",
        "et cins",
        "active threat",
        "reputation ip",
        "relay",
        "malicious host",
        "ice fog",
        "mail spammer",
        "brute force",
        "as11404",
        "first",
        "phishing site",
        "malicious url",
        "heur",
        "riskware",
        "agent",
        "unsafe",
        "download",
        "opencandy",
        "exploit",
        "mimikatz",
        "quasar rat",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "azorult",
        "service",
        "runescape",
        "union",
        "beach research",
        "drones",
        "miles2",
        "songculture attacked",
        "phishing",
        "monitoring",
        "mailtrak",
        "tracking",
        "geoapy",
        "location tracking",
        "obsession"
      ],
      "references": [],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "Domains",
          "display_name": "Domains",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65418472eb20b10ee5510fde",
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3121,
        "domain": 1121,
        "hostname": 972,
        "FileHash-SHA256": 564,
        "email": 2,
        "CVE": 4,
        "FileHash-MD5": 74,
        "FileHash-SHA1": 39
      },
      "indicator_count": 5897,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "813 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65418472eb20b10ee5510fde",
      "name": "Australia Immortal | Ponmicup | Beach Research",
      "description": "Okay, Michael Roberts of Rexxfield[.]com is an alleged cyber security hacker, victim, adversary, etc. As far as I  go back he is attached defacement. Mr. SQL. Allegedly works for attorneys. Cover up guy. I don't know if he is real despite the incredible stories online from capturing a murderer to being married to one. Based on what I've read he avenges medical professionals who commit crimes by attacking and silencing and his favorite injection. I was looking at device, a remote video from MILESIT.COM covered entire screen. (Auto populated: The results of an analysis of more than 400,000 IP addresses found on the OpenPhish website, compiled by the Phishing Research Team, have been published on Facebook, Twitter and Facebook.)",
      "modified": "2023-11-30T22:00:36.762000",
      "created": "2023-10-31T22:49:22.495000",
      "tags": [
        "url https",
        "url http",
        "months ago",
        "michael roberts",
        "scan endpoints",
        "all milesit",
        "octoseek report",
        "spam author",
        "modified",
        "handle",
        "next",
        "returnurl",
        "potential",
        "ipv4",
        "rexxfield",
        "cyber threat",
        "united",
        "malicious",
        "team phishing",
        "hostname",
        "malware site",
        "coalition",
        "control server",
        "covid19",
        "malicious site",
        "malware",
        "team",
        "phishing",
        "virustotal",
        "bank",
        "facebook",
        "plasma",
        "kraken",
        "redline stealer",
        "citadel",
        "zeus",
        "ransomware",
        "zbot",
        "emotet",
        "simda",
        "pykspa",
        "inmortal",
        "domains",
        "detection list",
        "blacklist",
        "generic malware",
        "blacklist https",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "ponmocup",
        "tsara brashears",
        "name verdict",
        "falcon sandbox",
        "et cins",
        "active threat",
        "reputation ip",
        "relay",
        "malicious host",
        "ice fog",
        "mail spammer",
        "brute force",
        "as11404",
        "first",
        "phishing site",
        "malicious url",
        "heur",
        "riskware",
        "agent",
        "unsafe",
        "download",
        "opencandy",
        "exploit",
        "mimikatz",
        "quasar rat",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "azorult",
        "service",
        "runescape",
        "union",
        "beach research",
        "drones",
        "miles2",
        "songculture attacked",
        "phishing",
        "monitoring",
        "mailtrak",
        "tracking",
        "geoapy",
        "location tracking",
        "obsession"
      ],
      "references": [],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "Domains",
          "display_name": "Domains",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 50,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3121,
        "domain": 1121,
        "hostname": 972,
        "FileHash-SHA256": 564,
        "email": 2,
        "CVE": 4,
        "FileHash-MD5": 74,
        "FileHash-SHA1": 39
      },
      "indicator_count": 5897,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6544cc36799d1c45c82c1ed7",
      "name": "Australia Immortal | Ponmicup | Beach Research",
      "description": "",
      "modified": "2023-11-30T22:00:36.762000",
      "created": "2023-11-03T10:32:22.249000",
      "tags": [
        "url https",
        "url http",
        "months ago",
        "michael roberts",
        "scan endpoints",
        "all milesit",
        "octoseek report",
        "spam author",
        "modified",
        "handle",
        "next",
        "returnurl",
        "potential",
        "ipv4",
        "rexxfield",
        "cyber threat",
        "united",
        "malicious",
        "team phishing",
        "hostname",
        "malware site",
        "coalition",
        "control server",
        "covid19",
        "malicious site",
        "malware",
        "team",
        "phishing",
        "virustotal",
        "bank",
        "facebook",
        "plasma",
        "kraken",
        "redline stealer",
        "citadel",
        "zeus",
        "ransomware",
        "zbot",
        "emotet",
        "simda",
        "pykspa",
        "inmortal",
        "domains",
        "detection list",
        "blacklist",
        "generic malware",
        "blacklist https",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "ponmocup",
        "tsara brashears",
        "name verdict",
        "falcon sandbox",
        "et cins",
        "active threat",
        "reputation ip",
        "relay",
        "malicious host",
        "ice fog",
        "mail spammer",
        "brute force",
        "as11404",
        "first",
        "phishing site",
        "malicious url",
        "heur",
        "riskware",
        "agent",
        "unsafe",
        "download",
        "opencandy",
        "exploit",
        "mimikatz",
        "quasar rat",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "azorult",
        "service",
        "runescape",
        "union",
        "beach research",
        "drones",
        "miles2",
        "songculture attacked",
        "phishing",
        "monitoring",
        "mailtrak",
        "tracking",
        "geoapy",
        "location tracking",
        "obsession"
      ],
      "references": [],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "Domains",
          "display_name": "Domains",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65418472eb20b10ee5510fde",
      "export_count": 53,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3121,
        "domain": 1121,
        "hostname": 972,
        "FileHash-SHA256": 564,
        "email": 2,
        "CVE": 4,
        "FileHash-MD5": 74,
        "FileHash-SHA1": 39
      },
      "indicator_count": 5897,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65459d8355ffcc57175db685",
      "name": "Australia Immortal | Ponmicup | Beach Research",
      "description": "",
      "modified": "2023-11-30T22:00:36.762000",
      "created": "2023-11-04T01:25:23.996000",
      "tags": [
        "url https",
        "url http",
        "months ago",
        "michael roberts",
        "scan endpoints",
        "all milesit",
        "octoseek report",
        "spam author",
        "modified",
        "handle",
        "next",
        "returnurl",
        "potential",
        "ipv4",
        "rexxfield",
        "cyber threat",
        "united",
        "malicious",
        "team phishing",
        "hostname",
        "malware site",
        "coalition",
        "control server",
        "covid19",
        "malicious site",
        "malware",
        "team",
        "phishing",
        "virustotal",
        "bank",
        "facebook",
        "plasma",
        "kraken",
        "redline stealer",
        "citadel",
        "zeus",
        "ransomware",
        "zbot",
        "emotet",
        "simda",
        "pykspa",
        "inmortal",
        "domains",
        "detection list",
        "blacklist",
        "generic malware",
        "blacklist https",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "ponmocup",
        "tsara brashears",
        "name verdict",
        "falcon sandbox",
        "et cins",
        "active threat",
        "reputation ip",
        "relay",
        "malicious host",
        "ice fog",
        "mail spammer",
        "brute force",
        "as11404",
        "first",
        "phishing site",
        "malicious url",
        "heur",
        "riskware",
        "agent",
        "unsafe",
        "download",
        "opencandy",
        "exploit",
        "mimikatz",
        "quasar rat",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "azorult",
        "service",
        "runescape",
        "union",
        "beach research",
        "drones",
        "miles2",
        "songculture attacked",
        "phishing",
        "monitoring",
        "mailtrak",
        "tracking",
        "geoapy",
        "location tracking",
        "obsession"
      ],
      "references": [],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "Domains",
          "display_name": "Domains",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6544cc36799d1c45c82c1ed7",
      "export_count": 49,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3121,
        "domain": 1121,
        "hostname": 972,
        "FileHash-SHA256": 564,
        "email": 2,
        "CVE": 4,
        "FileHash-MD5": 74,
        "FileHash-SHA1": 39
      },
      "indicator_count": 5897,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "secdeck.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "secdeck.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780265909.6969318
}