{
  "type": "Domain",
  "indicator": "spidtest.space",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/spidtest.space",
    "alexa": "http://www.alexa.com/siteinfo/spidtest.space",
    "indicator": "spidtest.space",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2672822536,
      "indicator": "spidtest.space",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "655ad83180deb1186bb4f466",
          "name": "Carrotbat Malware | Stalker Suite |  gogglemaps.com",
          "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools, botnetwork \nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)",
          "modified": "2023-12-20T02:02:59.943000",
          "created": "2023-11-20T03:53:21.699000",
          "tags": [
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "tls web",
            "encrypt",
            "ca issuers",
            "f9970e",
            "bd6en timestamp",
            "a487132c3b",
            "false",
            "ssl certificate",
            "tsara brashears",
            "contacted",
            "referrer",
            "copy",
            "historical ssl",
            "collections",
            "password",
            "networks",
            "botnet campaign",
            "skynet",
            "fall",
            "hacktool",
            "malware",
            "critical",
            "relic",
            "monitoring",
            "attack",
            "hiddentear",
            "metro",
            "test",
            "detection list",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "temp",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "unknown",
            "meta",
            "span",
            "error",
            "refresh",
            "body",
            "generator",
            "look",
            "verify",
            "restart",
            "hybrid",
            "accept",
            "click",
            "strings",
            "tools",
            "whois record",
            "msgid10053",
            "msgid10051",
            "communicating",
            "anid",
            "execution",
            "null",
            "core",
            "installer",
            "threat roundup",
            "apple ios",
            "august",
            "highly targeted",
            "apple",
            "sqli dumper",
            "april",
            "february",
            "awful",
            "radar ineractive",
            "october",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "cisco umbrella",
            "site",
            "wormx",
            "malicious site",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "phishing site",
            "alexa",
            "phishing",
            "agent",
            "bank",
            "inmortal",
            "united",
            "cyber threat",
            "pony",
            "cnc zeus",
            "tracker",
            "cnc server",
            "covid19",
            "engineering",
            "http spammer",
            "host",
            "azorult",
            "asyncrat",
            "cobalt strike",
            "team",
            "hsbc",
            "noname057",
            "generic malware",
            "blacklist http",
            "malicious url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 815,
            "FileHash-SHA256": 3404,
            "SSLCertFingerprint": 2,
            "URL": 8938,
            "domain": 1195,
            "hostname": 2705,
            "FileHash-SHA1": 457,
            "CIDR": 7,
            "CVE": 3
          },
          "indicator_count": 17526,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "894 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ad8e83914549cd4658f8e",
          "name": "Radar Ineractive \u2022 Inmortal \u2022 HSBC.com",
          "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools,\nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)\nRadar Ineractive \u2022 Inmortal \u2022 HSBC.com",
          "modified": "2023-12-20T02:02:59.943000",
          "created": "2023-11-20T03:56:24.105000",
          "tags": [
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "tls web",
            "encrypt",
            "ca issuers",
            "f9970e",
            "bd6en timestamp",
            "a487132c3b",
            "false",
            "ssl certificate",
            "tsara brashears",
            "contacted",
            "referrer",
            "copy",
            "historical ssl",
            "collections",
            "password",
            "networks",
            "botnet campaign",
            "skynet",
            "fall",
            "hacktool",
            "malware",
            "critical",
            "relic",
            "monitoring",
            "attack",
            "hiddentear",
            "metro",
            "test",
            "detection list",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "temp",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "unknown",
            "meta",
            "span",
            "error",
            "refresh",
            "body",
            "generator",
            "look",
            "verify",
            "restart",
            "hybrid",
            "accept",
            "click",
            "strings",
            "tools",
            "whois record",
            "msgid10053",
            "msgid10051",
            "communicating",
            "anid",
            "execution",
            "null",
            "core",
            "installer",
            "threat roundup",
            "apple ios",
            "august",
            "highly targeted",
            "apple",
            "sqli dumper",
            "april",
            "february",
            "awful",
            "radar ineractive",
            "october",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "cisco umbrella",
            "site",
            "wormx",
            "malicious site",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "phishing site",
            "alexa",
            "phishing",
            "agent",
            "bank",
            "inmortal",
            "united",
            "cyber threat",
            "pony",
            "cnc zeus",
            "tracker",
            "cnc server",
            "covid19",
            "engineering",
            "http spammer",
            "host",
            "azorult",
            "asyncrat",
            "cobalt strike",
            "team",
            "hsbc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 815,
            "FileHash-SHA256": 3404,
            "SSLCertFingerprint": 2,
            "URL": 8938,
            "domain": 1194,
            "hostname": 2705,
            "FileHash-SHA1": 457,
            "CIDR": 7,
            "CVE": 3
          },
          "indicator_count": 17525,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "894 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "657092eb7c26b2cfaf15afb2",
          "name": "Twitter Cards",
          "description": "",
          "modified": "2023-12-06T15:27:39.330000",
          "created": "2023-12-06T15:27:39.330000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 672,
            "domain": 647,
            "hostname": 803,
            "URL": 2896,
            "CVE": 1
          },
          "indicator_count": 5019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6341a53e0b5b54bf9de2b1a9",
          "name": "Twitter Cards",
          "description": "",
          "modified": "2022-11-07T16:01:58.911000",
          "created": "2022-10-08T16:28:46.313000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "pe resource",
            "historical ssl",
            "siblings domain",
            "referrer",
            "parent domain",
            "resolutions",
            "contacted urls",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2896,
            "hostname": 803,
            "domain": 647,
            "FileHash-SHA256": 672,
            "CVE": 1
          },
          "indicator_count": 5019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 405,
          "modified_text": "1302 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "629f32000e99da994ecb5f62",
          "name": "80880.bodis - passive DNS = CNAME bug cookie priv escalation 450 records = n. sh",
          "description": "ioc's from all passive dns records potentially using CNAME record cookie priv escalation bug to abuse and break analytics with user agent.\nmass of 404 connection errors invoked to hijack/redir traffic to top level immitation sites running on massive nubotnet",
          "modified": "2022-07-07T00:01:42.558000",
          "created": "2022-06-07T11:09:52.102000",
          "tags": [
            "n. sh",
            "CNAME cookie priv escalation",
            "CVE-2021-22941",
            "ww1",
            "neural",
            "nubotnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 370,
            "hostname": 1775,
            "URL": 2331,
            "domain": 453
          },
          "indicator_count": 4929,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1425 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Hsbc",
            "Radar ineractive",
            "Inmortal"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "655ad83180deb1186bb4f466",
      "name": "Carrotbat Malware | Stalker Suite |  gogglemaps.com",
      "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools, botnetwork \nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)",
      "modified": "2023-12-20T02:02:59.943000",
      "created": "2023-11-20T03:53:21.699000",
      "tags": [
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "tls web",
        "encrypt",
        "ca issuers",
        "f9970e",
        "bd6en timestamp",
        "a487132c3b",
        "false",
        "ssl certificate",
        "tsara brashears",
        "contacted",
        "referrer",
        "copy",
        "historical ssl",
        "collections",
        "password",
        "networks",
        "botnet campaign",
        "skynet",
        "fall",
        "hacktool",
        "malware",
        "critical",
        "relic",
        "monitoring",
        "attack",
        "hiddentear",
        "metro",
        "test",
        "detection list",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "temp",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "unknown",
        "meta",
        "span",
        "error",
        "refresh",
        "body",
        "generator",
        "look",
        "verify",
        "restart",
        "hybrid",
        "accept",
        "click",
        "strings",
        "tools",
        "whois record",
        "msgid10053",
        "msgid10051",
        "communicating",
        "anid",
        "execution",
        "null",
        "core",
        "installer",
        "threat roundup",
        "apple ios",
        "august",
        "highly targeted",
        "apple",
        "sqli dumper",
        "april",
        "february",
        "awful",
        "radar ineractive",
        "october",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist",
        "cisco umbrella",
        "site",
        "wormx",
        "malicious site",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "phishing site",
        "alexa",
        "phishing",
        "agent",
        "bank",
        "inmortal",
        "united",
        "cyber threat",
        "pony",
        "cnc zeus",
        "tracker",
        "cnc server",
        "covid19",
        "engineering",
        "http spammer",
        "host",
        "azorult",
        "asyncrat",
        "cobalt strike",
        "team",
        "hsbc",
        "noname057",
        "generic malware",
        "blacklist http",
        "malicious url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Radar Ineractive",
          "display_name": "Radar Ineractive",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 815,
        "FileHash-SHA256": 3404,
        "SSLCertFingerprint": 2,
        "URL": 8938,
        "domain": 1195,
        "hostname": 2705,
        "FileHash-SHA1": 457,
        "CIDR": 7,
        "CVE": 3
      },
      "indicator_count": 17526,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "894 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ad8e83914549cd4658f8e",
      "name": "Radar Ineractive \u2022 Inmortal \u2022 HSBC.com",
      "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools,\nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)\nRadar Ineractive \u2022 Inmortal \u2022 HSBC.com",
      "modified": "2023-12-20T02:02:59.943000",
      "created": "2023-11-20T03:56:24.105000",
      "tags": [
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "tls web",
        "encrypt",
        "ca issuers",
        "f9970e",
        "bd6en timestamp",
        "a487132c3b",
        "false",
        "ssl certificate",
        "tsara brashears",
        "contacted",
        "referrer",
        "copy",
        "historical ssl",
        "collections",
        "password",
        "networks",
        "botnet campaign",
        "skynet",
        "fall",
        "hacktool",
        "malware",
        "critical",
        "relic",
        "monitoring",
        "attack",
        "hiddentear",
        "metro",
        "test",
        "detection list",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "temp",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "unknown",
        "meta",
        "span",
        "error",
        "refresh",
        "body",
        "generator",
        "look",
        "verify",
        "restart",
        "hybrid",
        "accept",
        "click",
        "strings",
        "tools",
        "whois record",
        "msgid10053",
        "msgid10051",
        "communicating",
        "anid",
        "execution",
        "null",
        "core",
        "installer",
        "threat roundup",
        "apple ios",
        "august",
        "highly targeted",
        "apple",
        "sqli dumper",
        "april",
        "february",
        "awful",
        "radar ineractive",
        "october",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist",
        "cisco umbrella",
        "site",
        "wormx",
        "malicious site",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "phishing site",
        "alexa",
        "phishing",
        "agent",
        "bank",
        "inmortal",
        "united",
        "cyber threat",
        "pony",
        "cnc zeus",
        "tracker",
        "cnc server",
        "covid19",
        "engineering",
        "http spammer",
        "host",
        "azorult",
        "asyncrat",
        "cobalt strike",
        "team",
        "hsbc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Radar Ineractive",
          "display_name": "Radar Ineractive",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 815,
        "FileHash-SHA256": 3404,
        "SSLCertFingerprint": 2,
        "URL": 8938,
        "domain": 1194,
        "hostname": 2705,
        "FileHash-SHA1": 457,
        "CIDR": 7,
        "CVE": 3
      },
      "indicator_count": 17525,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "894 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "657092eb7c26b2cfaf15afb2",
      "name": "Twitter Cards",
      "description": "",
      "modified": "2023-12-06T15:27:39.330000",
      "created": "2023-12-06T15:27:39.330000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 672,
        "domain": 647,
        "hostname": 803,
        "URL": 2896,
        "CVE": 1
      },
      "indicator_count": 5019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6341a53e0b5b54bf9de2b1a9",
      "name": "Twitter Cards",
      "description": "",
      "modified": "2022-11-07T16:01:58.911000",
      "created": "2022-10-08T16:28:46.313000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "pe resource",
        "historical ssl",
        "siblings domain",
        "referrer",
        "parent domain",
        "resolutions",
        "contacted urls",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2896,
        "hostname": 803,
        "domain": 647,
        "FileHash-SHA256": 672,
        "CVE": 1
      },
      "indicator_count": 5019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 405,
      "modified_text": "1302 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "629f32000e99da994ecb5f62",
      "name": "80880.bodis - passive DNS = CNAME bug cookie priv escalation 450 records = n. sh",
      "description": "ioc's from all passive dns records potentially using CNAME record cookie priv escalation bug to abuse and break analytics with user agent.\nmass of 404 connection errors invoked to hijack/redir traffic to top level immitation sites running on massive nubotnet",
      "modified": "2022-07-07T00:01:42.558000",
      "created": "2022-06-07T11:09:52.102000",
      "tags": [
        "n. sh",
        "CNAME cookie priv escalation",
        "CVE-2021-22941",
        "ww1",
        "neural",
        "nubotnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 370,
        "hostname": 1775,
        "URL": 2331,
        "domain": 453
      },
      "indicator_count": 4929,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 395,
      "modified_text": "1425 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "spidtest.space",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "spidtest.space",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780342254.4092371
}