{
  "type": "Domain",
  "indicator": "turingtech.co",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/turingtech.co",
    "alexa": "http://www.alexa.com/siteinfo/turingtech.co",
    "indicator": "turingtech.co",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3316910812,
      "indicator": "turingtech.co",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "69f2dc7e076cbfe2d0f7eb90",
          "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
          "description": "",
          "modified": "2026-05-30T00:28:12.957000",
          "created": "2026-04-30T04:37:18.870000",
          "tags": [
            "united",
            "as397240",
            "search",
            "showing",
            "as54113",
            "as397241",
            "unknown",
            "moved",
            "creation date",
            "record value",
            "next",
            "date",
            "body",
            "a domains",
            "passive dns",
            "formbook cnc",
            "checkin",
            "entries",
            "github pages",
            "sea x",
            "accept",
            "status",
            "name servers",
            "certificate",
            "urls",
            "aaaa",
            "cname",
            "meta",
            "whitelisted ip",
            "address",
            "location united",
            "asn as36459",
            "github",
            "less whois",
            "registrar",
            "markmonitor",
            "related tags",
            "as36459",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "ninite",
            "expiration date",
            "domain",
            "hostname",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "document file",
            "v2 document",
            "utf8",
            "crlf line",
            "beginstring",
            "size",
            "null",
            "hybrid",
            "refresh",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "url https",
            "tulach type",
            "role title",
            "added active",
            "pulses url",
            "url http",
            "nextc type",
            "type indicator",
            "related pulses",
            "filehashsha256",
            "copyright",
            "ipv6",
            "germany",
            "italy",
            "trojan",
            "trojanspy",
            "worm",
            "trojanclicker",
            "virtool",
            "service",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "collisionbox",
            "runner",
            "gameoverpanel",
            "trex",
            "orgtechhandle",
            "orgtechref",
            "director",
            "university",
            "nethandle",
            "net168",
            "net1680000",
            "ucha",
            "orgid",
            "east",
            "report spam",
            "as8075",
            "servers",
            "secure server",
            "error all",
            "typeof",
            "error f",
            "crazy doll",
            "created",
            "filehashmd5",
            "types of",
            "russia",
            "emotet type",
            "mirai type",
            "mirai",
            "mtb description",
            "win32 type",
            "as31034 aruba",
            "italy unknown",
            "as19527 google",
            "encrypt",
            "health type",
            "miori hackers",
            "brute force",
            "backdoor",
            "aurora",
            "ip address",
            "path",
            "unis",
            "dotcisoffer",
            "bladabindi",
            "artro",
            "script urls",
            "as46606",
            "brazil unknown",
            "as11284",
            "as10906",
            "apache",
            "lanc type",
            "telper",
            "win32",
            "win64",
            "pulses email",
            "as9009 m247",
            "as7296 alchemy",
            "as14061",
            "as16276",
            "trojandropper",
            "ransom",
            "mtb sep",
            "msie",
            "chrome",
            "ip check",
            "gmt content",
            "pulse submit",
            "url analysis",
            "files ip",
            "aaaa nxdomain",
            "nxdomain",
            "a nxdomain",
            "as22612",
            "dnssec",
            "meta http",
            "accept encoding",
            "request id",
            "united kingdom",
            "div div",
            "arial helvetica",
            "emails",
            "as15169 google",
            "cryp",
            "gmt cache",
            "sameorigin",
            "domain name",
            "code",
            "false",
            "command type",
            "roleselfservice",
            "mcig sep",
            "all search",
            "author avatar",
            "days ago",
            "http",
            "related nids",
            "files location",
            "as30081",
            "gmt contenttype",
            "mozilla",
            "as15133 verizon",
            "whitelisted",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "softcnapp",
            "overview ip",
            "flag united",
            "files related",
            "as62597 nsone",
            "as31898 oracle",
            "mtb aug",
            "class",
            "twitter",
            "april",
            "secure",
            "httponly",
            "expiresthu",
            "pragma",
            "as13414 twitter",
            "smoke loader",
            "reverse dns",
            "asnone united",
            "idlogin sep",
            "uid38009",
            "expiration",
            "hack type",
            "porn type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Aruba"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66fc29a49b5ac693c8d75122",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3851,
            "FileHash-MD5": 6012,
            "FileHash-SHA1": 5906,
            "domain": 3330,
            "email": 33,
            "hostname": 4231,
            "CVE": 2,
            "FileHash-SHA256": 8407,
            "CIDR": 2,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 31781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1 day ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f2dc7db0bb5c5cdaec5a6c",
          "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
          "description": "",
          "modified": "2026-04-30T04:53:09.713000",
          "created": "2026-04-30T04:37:17.546000",
          "tags": [
            "united",
            "as397240",
            "search",
            "showing",
            "as54113",
            "as397241",
            "unknown",
            "moved",
            "creation date",
            "record value",
            "next",
            "date",
            "body",
            "a domains",
            "passive dns",
            "formbook cnc",
            "checkin",
            "entries",
            "github pages",
            "sea x",
            "accept",
            "status",
            "name servers",
            "certificate",
            "urls",
            "aaaa",
            "cname",
            "meta",
            "whitelisted ip",
            "address",
            "location united",
            "asn as36459",
            "github",
            "less whois",
            "registrar",
            "markmonitor",
            "related tags",
            "as36459",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "ninite",
            "expiration date",
            "domain",
            "hostname",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "document file",
            "v2 document",
            "utf8",
            "crlf line",
            "beginstring",
            "size",
            "null",
            "hybrid",
            "refresh",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "url https",
            "tulach type",
            "role title",
            "added active",
            "pulses url",
            "url http",
            "nextc type",
            "type indicator",
            "related pulses",
            "filehashsha256",
            "copyright",
            "ipv6",
            "germany",
            "italy",
            "trojan",
            "trojanspy",
            "worm",
            "trojanclicker",
            "virtool",
            "service",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "collisionbox",
            "runner",
            "gameoverpanel",
            "trex",
            "orgtechhandle",
            "orgtechref",
            "director",
            "university",
            "nethandle",
            "net168",
            "net1680000",
            "ucha",
            "orgid",
            "east",
            "report spam",
            "as8075",
            "servers",
            "secure server",
            "error all",
            "typeof",
            "error f",
            "crazy doll",
            "created",
            "filehashmd5",
            "types of",
            "russia",
            "emotet type",
            "mirai type",
            "mirai",
            "mtb description",
            "win32 type",
            "as31034 aruba",
            "italy unknown",
            "as19527 google",
            "encrypt",
            "health type",
            "miori hackers",
            "brute force",
            "backdoor",
            "aurora",
            "ip address",
            "path",
            "unis",
            "dotcisoffer",
            "bladabindi",
            "artro",
            "script urls",
            "as46606",
            "brazil unknown",
            "as11284",
            "as10906",
            "apache",
            "lanc type",
            "telper",
            "win32",
            "win64",
            "pulses email",
            "as9009 m247",
            "as7296 alchemy",
            "as14061",
            "as16276",
            "trojandropper",
            "ransom",
            "mtb sep",
            "msie",
            "chrome",
            "ip check",
            "gmt content",
            "pulse submit",
            "url analysis",
            "files ip",
            "aaaa nxdomain",
            "nxdomain",
            "a nxdomain",
            "as22612",
            "dnssec",
            "meta http",
            "accept encoding",
            "request id",
            "united kingdom",
            "div div",
            "arial helvetica",
            "emails",
            "as15169 google",
            "cryp",
            "gmt cache",
            "sameorigin",
            "domain name",
            "code",
            "false",
            "command type",
            "roleselfservice",
            "mcig sep",
            "all search",
            "author avatar",
            "days ago",
            "http",
            "related nids",
            "files location",
            "as30081",
            "gmt contenttype",
            "mozilla",
            "as15133 verizon",
            "whitelisted",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "softcnapp",
            "overview ip",
            "flag united",
            "files related",
            "as62597 nsone",
            "as31898 oracle",
            "mtb aug",
            "class",
            "twitter",
            "april",
            "secure",
            "httponly",
            "expiresthu",
            "pragma",
            "as13414 twitter",
            "smoke loader",
            "reverse dns",
            "asnone united",
            "idlogin sep",
            "uid38009",
            "expiration",
            "hack type",
            "porn type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Aruba"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66fc29a49b5ac693c8d75122",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3851,
            "FileHash-MD5": 6012,
            "FileHash-SHA1": 5906,
            "domain": 3330,
            "email": 33,
            "hostname": 4231,
            "CVE": 2,
            "FileHash-SHA256": 8407,
            "CIDR": 2,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 31781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "31 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66fc29a49b5ac693c8d75122",
          "name": "Medical Campus - Aurora, Co | Recheck",
          "description": "This weekend we found a busybox MIORI Hackers - serious attack Aurora, Medical Campus -Mirai. This recheck is generic. All results generated automatically by LevelBlue, sourced by ScoreBlue.\nMaybe it will be clean today. Complaints of pop up auto logins on locked screens and autonomous system running alongside actual system. System root.\nMalware Families:\nTrojanDownloader:Win32/Bulilit, ELF:Mirai-TO\\ [Trj], Backdoor:Linux/Mirai.B, TELPER:HSTR:DotCisOffer, TrojanSpy:Win32/Nivdort, Backdoor:Win32/Bladabindi, ALF:E5, Win.Malware.Midie-9950743-0, Trojan:Win32/Emotet.ARJ!MTB",
          "modified": "2024-10-31T16:03:52.240000",
          "created": "2024-10-01T16:56:04.004000",
          "tags": [
            "united",
            "as397240",
            "search",
            "showing",
            "as54113",
            "as397241",
            "unknown",
            "moved",
            "creation date",
            "record value",
            "next",
            "date",
            "body",
            "a domains",
            "passive dns",
            "formbook cnc",
            "checkin",
            "entries",
            "github pages",
            "sea x",
            "accept",
            "status",
            "name servers",
            "certificate",
            "urls",
            "aaaa",
            "cname",
            "meta",
            "whitelisted ip",
            "address",
            "location united",
            "asn as36459",
            "github",
            "less whois",
            "registrar",
            "markmonitor",
            "related tags",
            "as36459",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "ninite",
            "expiration date",
            "domain",
            "hostname",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "document file",
            "v2 document",
            "utf8",
            "crlf line",
            "beginstring",
            "size",
            "null",
            "hybrid",
            "refresh",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "url https",
            "tulach type",
            "role title",
            "added active",
            "pulses url",
            "url http",
            "nextc type",
            "type indicator",
            "related pulses",
            "filehashsha256",
            "copyright",
            "ipv6",
            "germany",
            "italy",
            "trojan",
            "trojanspy",
            "worm",
            "trojanclicker",
            "virtool",
            "service",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "collisionbox",
            "runner",
            "gameoverpanel",
            "trex",
            "orgtechhandle",
            "orgtechref",
            "director",
            "university",
            "nethandle",
            "net168",
            "net1680000",
            "ucha",
            "orgid",
            "east",
            "report spam",
            "as8075",
            "servers",
            "secure server",
            "error all",
            "typeof",
            "error f",
            "crazy doll",
            "created",
            "filehashmd5",
            "types of",
            "russia",
            "emotet type",
            "mirai type",
            "mirai",
            "mtb description",
            "win32 type",
            "as31034 aruba",
            "italy unknown",
            "as19527 google",
            "encrypt",
            "health type",
            "miori hackers",
            "brute force",
            "backdoor",
            "aurora",
            "ip address",
            "path",
            "unis",
            "dotcisoffer",
            "bladabindi",
            "artro",
            "script urls",
            "as46606",
            "brazil unknown",
            "as11284",
            "as10906",
            "apache",
            "lanc type",
            "telper",
            "win32",
            "win64",
            "pulses email",
            "as9009 m247",
            "as7296 alchemy",
            "as14061",
            "as16276",
            "trojandropper",
            "ransom",
            "mtb sep",
            "msie",
            "chrome",
            "ip check",
            "gmt content",
            "pulse submit",
            "url analysis",
            "files ip",
            "aaaa nxdomain",
            "nxdomain",
            "a nxdomain",
            "as22612",
            "dnssec",
            "meta http",
            "accept encoding",
            "request id",
            "united kingdom",
            "div div",
            "arial helvetica",
            "emails",
            "as15169 google",
            "cryp",
            "gmt cache",
            "sameorigin",
            "domain name",
            "code",
            "false",
            "command type",
            "roleselfservice",
            "mcig sep",
            "all search",
            "author avatar",
            "days ago",
            "http",
            "related nids",
            "files location",
            "as30081",
            "gmt contenttype",
            "mozilla",
            "as15133 verizon",
            "whitelisted",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "softcnapp",
            "overview ip",
            "flag united",
            "files related",
            "as62597 nsone",
            "as31898 oracle",
            "mtb aug",
            "class",
            "twitter",
            "april",
            "secure",
            "httponly",
            "expiresthu",
            "pragma",
            "as13414 twitter",
            "smoke loader",
            "reverse dns",
            "asnone united",
            "idlogin sep",
            "uid38009",
            "expiration",
            "hack type",
            "porn type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Aruba"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 53,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3850,
            "FileHash-MD5": 6012,
            "FileHash-SHA1": 5906,
            "domain": 3329,
            "email": 33,
            "hostname": 4231,
            "CVE": 2,
            "FileHash-SHA256": 8407,
            "CIDR": 2,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 31779,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 236,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "659b4cea3e6da3a00306ae11",
          "name": "Ragnar Locker | Cowrie Hash",
          "description": "Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and shell interaction performed by an attacker. Cowrie also functions as an SSH and telnet proxy to observe attacker behavior to another system. Cowrie was developed from Kippo.\n\nRagnar Locker: \nAffected platforms: Microsoft Windows\nImpacted parties: Microsoft Windows  & Linux Users\nImpact: Encrypts files on the compromised machine and demands ransom for file decryption\nSeverity level: High\n\nI'm not sure. It seems this 'Law' group aquires and sell your digital profiles, PHI. PII, Banking , Insurance credentials on the dark web.",
          "modified": "2024-02-06T23:04:54.022000",
          "created": "2024-01-08T01:16:26.884000",
          "tags": [
            "contacted",
            "pe resource",
            "execution",
            "problems",
            "alienvault part",
            "dropped",
            "kgs0",
            "kls0",
            "collections",
            "schema abuse",
            "iframe",
            "united",
            "as29791",
            "search",
            "entries",
            "passive dns",
            "urls",
            "service",
            "date",
            "unknown",
            "japan unknown",
            "body",
            "czechia unknown",
            "sinkhole",
            "emotet",
            "date hash",
            "avast avg",
            "mtb dec",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "samples",
            "tulach",
            "tulach.cc",
            "sabey data center",
            "malware server",
            "gorf",
            "set cookie",
            "united kingdom",
            "script urls",
            "trojan",
            "status",
            "showing",
            "cookie",
            "template",
            "johnnsabey",
            "briansabey",
            "data center",
            "choco",
            "name",
            "win32 exe",
            "domains",
            "registrar",
            "markmonitor inc",
            "ip detections",
            "country",
            "us execution",
            "parents",
            "whois record",
            "whois whois",
            "ssl certificate",
            "apple ios",
            "red team",
            "tsara brashears",
            "historical ssl",
            "hacktool",
            "copy",
            "malicious",
            "life",
            "unsafe",
            "server",
            "registrar abuse",
            "contact phone",
            "domain status",
            "registrar whois",
            "email",
            "registry domain",
            "registry expiry",
            "algorithm",
            "v3 serial",
            "number",
            "issuer",
            "key algorithm",
            "ec oid",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "info",
            "first",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "intel",
            "ms windows",
            "write c",
            "pe32",
            "pe32 executable",
            "copy c",
            "show",
            "free",
            "recon",
            "benjamin",
            "write",
            "worm",
            "win32",
            "june",
            "delphi",
            "code",
            "malware",
            "next",
            "using",
            "urls http",
            "benjamin",
            "nids",
            "cowrie hashes",
            "dns replication",
            "files",
            "sample",
            "sender",
            "us postal",
            "cowrie",
            "iranian actor",
            "shipping",
            "healthcare",
            "ragnar locker",
            "qakbot",
            "qbot",
            "pii",
            "phi",
            "privacy",
            "honeypot",
            "referrer",
            "spyware",
            "android",
            "nanocore",
            "banker",
            "keylogger"
          ],
          "references": [
            "choco.exe",
            "media-router-fp74.prod.media.vip.bf1.yahoo.com",
            "https://www.cybereason.com/blog/threat-analysis-report-ragnar-locker-ransomware-targeting-the-energy-sector?hs_amp=true",
            "httphttp://security.didici.cc/cves://www.sentinelone.com/anthology/ragnar-locker/",
            "http://security.didici.cc/cve",
            "https://whois.domaintools.com/gov1.info",
            "https://nsa.gov1.info/utah-data-center/",
            "https://github.com/cowrie/cowrie",
            "Cowrie (honeypot) - Wikipedia",
            "https://www.fortinet.com/blog/threat-research/ransomware-roundup-ragnar-locker-ransomware"
          ],
          "public": 1,
          "adversary": "Ragnar Locker | M. Brian Sabey | HallRender| Tulach | Benjamin",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "ALF:Win32/GbdInf_123DF591.J!ibt",
              "display_name": "ALF:Win32/GbdInf_123DF591.J!ibt",
              "target": "/malware/ALF:Win32/GbdInf_123DF591.J!ibt"
            },
            {
              "id": "SABEY",
              "display_name": "SABEY",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/Cassini_f28c33a2!ibt",
              "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2!ibt",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/Cassini_ade36583!ibt",
              "display_name": "ALF:Trojan:Win32/Cassini_ade36583!ibt",
              "target": null
            },
            {
              "id": "ALF:Ransom:Win32/Babax.SG!MTB",
              "display_name": "ALF:Ransom:Win32/Babax.SG!MTB",
              "target": null
            },
            {
              "id": "ALF:SpikeAexR.SECTHDR",
              "display_name": "ALF:SpikeAexR.SECTHDR",
              "target": null
            },
            {
              "id": "ALF:Trojan:MSIL/AgentTesla.KM",
              "display_name": "ALF:Trojan:MSIL/AgentTesla.KM",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker ,   ,  ALF:Trojan:Win32/AutoRun.PI!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker ,   ,  ALF:Trojan:Win32/AutoRun.PI!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Ransom:MSIL/Gorf",
              "display_name": "ALF:HeraklezEval:Ransom:MSIL/Gorf",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "Qbot",
              "display_name": "Qbot",
              "target": null
            },
            {
              "id": "Ragnar Locker",
              "display_name": "Ragnar Locker",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Worm",
              "display_name": "Worm",
              "target": null
            },
            {
              "id": "NanCore RAY",
              "display_name": "NanCore RAY",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [
            "Healthcare",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 347,
            "FileHash-SHA1": 222,
            "FileHash-SHA256": 6645,
            "hostname": 2744,
            "URL": 9123,
            "domain": 3065,
            "email": 4
          },
          "indicator_count": 22150,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "844 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "659261d5965b4824d1606cf9",
          "name": "Pegasus - a-poster.info",
          "description": "",
          "modified": "2024-01-31T04:00:35.757000",
          "created": "2024-01-01T06:55:17.262000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "ipv4",
            "expiration",
            "iocs",
            "ipv6",
            "url http",
            "url https",
            "next",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "cidr",
            "pcap",
            "stix",
            "subid",
            "mtsub26293293",
            "dashboard",
            "browse scan",
            "endpoints all",
            "octoseek",
            "a poster",
            "apple",
            "apple id",
            "apple engineering",
            "icloud",
            "tulach",
            "hallrender",
            "ck matrix",
            "ck id",
            "xobo",
            "a nxdomain",
            "sabey",
            "aaaa",
            "win32",
            "briansabey",
            "brian",
            "brian sabey",
            "urls https",
            "unknown urls",
            "united",
            "ttl value",
            "tsara brashears",
            "trojan",
            "tracker",
            "tofsee",
            "threat analyzer",
            "threat",
            "temp",
            "teams api",
            "subdomains",
            "active",
            "active threat",
            "strings",
            "status codes",
            "japan national police agency",
            "pegasus",
            "china",
            "aig",
            "ssl certificate",
            "accept",
            "ssh on server",
            "speakez securus",
            "show technique",
            "https",
            "relay",
            "state",
            "android",
            "address",
            "aposter",
            "workaposter",
            "sha256",
            "showing",
            "simple",
            "span",
            "small",
            "serving ip",
            "script",
            "search",
            "root",
            "ca",
            "samples",
            "root ca",
            "resolutions",
            "remote",
            "relay",
            "relacion",
            "referrer",
            "record value",
            "applenoc",
            "as16625",
            "attack",
            "apple attack",
            "bundled",
            "canvas",
            "mitre attk",
            "brute force passwords",
            "body length",
            "body",
            "backdoor",
            "bellsouth",
            "bahamut",
            "bell south",
            "mitre",
            "cellbrite",
            "class",
            "click",
            "authority",
            "contentencoding",
            "akamai",
            "as20940",
            "as24940 hetzner",
            "as58061 scalaxy",
            "scalaxy",
            "as714",
            "critical",
            "communicating",
            "quasar",
            "trojan",
            "et",
            "icefog",
            "pegasus",
            "tofsee",
            "cmd",
            "crypto",
            "error",
            "dns replication",
            "domain entries",
            "et cins",
            "execution",
            "cname",
            "config",
            "contact",
            "contacted",
            "copy",
            "creation date",
            "formbook",
            "jekyll",
            "graph",
            "germany unknown",
            "generator",
            "general",
            "forbidden",
            "falcon sandbox",
            "ssl hostname",
            "false",
            "file",
            "final url",
            "final url summary",
            "hashes files",
            "headers nel",
            "historical",
            "malicious host",
            "malvertizing",
            "malware",
            "tagging",
            "contextualizing",
            "localappdata",
            "install",
            "installer",
            "ioc search",
            "iocs kb",
            "body",
            "local",
            "United states",
            "name",
            "name servers",
            "mitre att",
            "metro",
            "meta",
            "mail spammer",
            "submit",
            "submit quasar",
            "phishing",
            "pattern match",
            "paste",
            "passive dns",
            "nxdomain",
            "national police agency japan",
            "network",
            "verdict",
            "cmd",
            "sandbox",
            "http response",
            "record type",
            "phishing",
            "nuance",
            "next",
            "new ioc",
            "subdomains",
            "germany",
            "reinsurance",
            "nuance",
            "cybercrime",
            "tracking",
            "cyber stalking",
            "fear",
            "masquerading",
            "cobalt strike"
          ],
          "references": [
            "a-poster.info",
            "https://tulach.cc/",
            "images.ctfassets.net",
            "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
            "nr-data.net [Apple Private Data Collection]",
            "http://gmpg.org/xfn/11 [HTTrack]",
            "192.229.211.108 [Tracking & Virus Network]",
            "me.com [Pegasus]",
            "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
            "37.1.217.172 [scanning host]",
            "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4719,
            "domain": 2497,
            "hostname": 3549,
            "FileHash-MD5": 4118,
            "FileHash-SHA1": 3496,
            "FileHash-SHA256": 5861,
            "CIDR": 12,
            "email": 17
          },
          "indicator_count": 24269,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "659261e2290ac1ecc5d9ca74",
          "name": "Pegasus - a-poster.info",
          "description": "",
          "modified": "2024-01-31T04:00:35.757000",
          "created": "2024-01-01T06:55:30.771000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "ipv4",
            "expiration",
            "iocs",
            "ipv6",
            "url http",
            "url https",
            "next",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "cidr",
            "pcap",
            "stix",
            "subid",
            "mtsub26293293",
            "dashboard",
            "browse scan",
            "endpoints all",
            "octoseek",
            "a poster",
            "apple",
            "apple id",
            "apple engineering",
            "icloud",
            "tulach",
            "hallrender",
            "ck matrix",
            "ck id",
            "xobo",
            "a nxdomain",
            "sabey",
            "aaaa",
            "win32",
            "briansabey",
            "brian",
            "brian sabey",
            "urls https",
            "unknown urls",
            "united",
            "ttl value",
            "tsara brashears",
            "trojan",
            "tracker",
            "tofsee",
            "threat analyzer",
            "threat",
            "temp",
            "teams api",
            "subdomains",
            "active",
            "active threat",
            "strings",
            "status codes",
            "japan national police agency",
            "pegasus",
            "china",
            "aig",
            "ssl certificate",
            "accept",
            "ssh on server",
            "speakez securus",
            "show technique",
            "https",
            "relay",
            "state",
            "android",
            "address",
            "aposter",
            "workaposter",
            "sha256",
            "showing",
            "simple",
            "span",
            "small",
            "serving ip",
            "script",
            "search",
            "root",
            "ca",
            "samples",
            "root ca",
            "resolutions",
            "remote",
            "relay",
            "relacion",
            "referrer",
            "record value",
            "applenoc",
            "as16625",
            "attack",
            "apple attack",
            "bundled",
            "canvas",
            "mitre attk",
            "brute force passwords",
            "body length",
            "body",
            "backdoor",
            "bellsouth",
            "bahamut",
            "bell south",
            "mitre",
            "cellbrite",
            "class",
            "click",
            "authority",
            "contentencoding",
            "akamai",
            "as20940",
            "as24940 hetzner",
            "as58061 scalaxy",
            "scalaxy",
            "as714",
            "critical",
            "communicating",
            "quasar",
            "trojan",
            "et",
            "icefog",
            "pegasus",
            "tofsee",
            "cmd",
            "crypto",
            "error",
            "dns replication",
            "domain entries",
            "et cins",
            "execution",
            "cname",
            "config",
            "contact",
            "contacted",
            "copy",
            "creation date",
            "formbook",
            "jekyll",
            "graph",
            "germany unknown",
            "generator",
            "general",
            "forbidden",
            "falcon sandbox",
            "ssl hostname",
            "false",
            "file",
            "final url",
            "final url summary",
            "hashes files",
            "headers nel",
            "historical",
            "malicious host",
            "malvertizing",
            "malware",
            "tagging",
            "contextualizing",
            "localappdata",
            "install",
            "installer",
            "ioc search",
            "iocs kb",
            "body",
            "local",
            "United states",
            "name",
            "name servers",
            "mitre att",
            "metro",
            "meta",
            "mail spammer",
            "submit",
            "submit quasar",
            "phishing",
            "pattern match",
            "paste",
            "passive dns",
            "nxdomain",
            "national police agency japan",
            "network",
            "verdict",
            "cmd",
            "sandbox",
            "http response",
            "record type",
            "phishing",
            "nuance",
            "next",
            "new ioc",
            "subdomains",
            "germany",
            "reinsurance",
            "nuance",
            "cybercrime",
            "tracking",
            "cyber stalking",
            "fear",
            "masquerading",
            "cobalt strike"
          ],
          "references": [
            "a-poster.info",
            "https://tulach.cc/",
            "images.ctfassets.net",
            "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
            "nr-data.net [Apple Private Data Collection]",
            "http://gmpg.org/xfn/11 [HTTrack]",
            "192.229.211.108 [Tracking & Virus Network]",
            "me.com [Pegasus]",
            "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
            "37.1.217.172 [scanning host]",
            "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Pegasus for iOS - S0289",
              "display_name": "Pegasus for iOS - S0289",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Trojan",
              "display_name": "Trojan",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4695,
            "domain": 2494,
            "hostname": 3547,
            "FileHash-MD5": 4118,
            "FileHash-SHA1": 3496,
            "FileHash-SHA256": 5841,
            "CIDR": 12,
            "email": 17
          },
          "indicator_count": 24220,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "851 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.cybereason.com/blog/threat-analysis-report-ragnar-locker-ransomware-targeting-the-energy-sector?hs_amp=true",
        "http://security.didici.cc/cve",
        "images.ctfassets.net",
        "https://nsa.gov1.info/utah-data-center/",
        "nr-data.net [Apple Private Data Collection]",
        "httphttp://security.didici.cc/cves://www.sentinelone.com/anthology/ragnar-locker/",
        "media-router-fp74.prod.media.vip.bf1.yahoo.com",
        "http://gmpg.org/xfn/11 [HTTrack]",
        "192.229.211.108 [Tracking & Virus Network]",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community",
        "https://tulach.cc/",
        "37.1.217.172 [scanning host]",
        "https://www.fortinet.com/blog/threat-research/ransomware-roundup-ragnar-locker-ransomware",
        "a-poster.info",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "choco.exe",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "https://whois.domaintools.com/gov1.info",
        "https://github.com/cowrie/cowrie",
        "me.com [Pegasus]",
        "Cowrie (honeypot) - Wikipedia"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Ragnar Locker | M. Brian Sabey | HallRender| Tulach | Benjamin"
          ],
          "malware_families": [
            "Formbook",
            "Tofsee",
            "Hacktool",
            "Alf:heraklezeval:ransom:msil/gorf",
            "Pegasus for android - mob-s0032",
            "Icefog",
            "Ragnar locker",
            "Pegasus - mob-s0005",
            "Cobalt strike",
            "Quasar rat",
            "Alf:trojan:win32/cassini_ade36583!ibt",
            "Hallrender",
            "Qbot",
            "Mirai",
            "Qakbot",
            "Alf:heraklezeval:trojan:win32/clipbanker ,   ,  alf:trojan:win32/autorun.pi!mtb ,  alf:trojan:win32/cassini_6d4ebdc9!ibt",
            "Pegasus for ios - s0289",
            "Nancore ray",
            "Worm",
            "Alf:trojan:msil/agenttesla.km",
            "Worm:win32/benjamin",
            "Emotet",
            "Alf:spikeaexr.secthdr",
            "Sabey",
            "Alf:trojan:win32/cassini_f28c33a2!ibt",
            "Alf:win32/gbdinf_123df591.j!ibt",
            "Alf:ransom:win32/babax.sg!mtb",
            "Artro",
            "Appleservice",
            "Tulach",
            "Trojan"
          ],
          "industries": [
            "Healthcare",
            "Insurance"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "69f2dc7e076cbfe2d0f7eb90",
      "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
      "description": "",
      "modified": "2026-05-30T00:28:12.957000",
      "created": "2026-04-30T04:37:18.870000",
      "tags": [
        "united",
        "as397240",
        "search",
        "showing",
        "as54113",
        "as397241",
        "unknown",
        "moved",
        "creation date",
        "record value",
        "next",
        "date",
        "body",
        "a domains",
        "passive dns",
        "formbook cnc",
        "checkin",
        "entries",
        "github pages",
        "sea x",
        "accept",
        "status",
        "name servers",
        "certificate",
        "urls",
        "aaaa",
        "cname",
        "meta",
        "whitelisted ip",
        "address",
        "location united",
        "asn as36459",
        "github",
        "less whois",
        "registrar",
        "markmonitor",
        "related tags",
        "as36459",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "ninite",
        "expiration date",
        "domain",
        "hostname",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "document file",
        "v2 document",
        "utf8",
        "crlf line",
        "beginstring",
        "size",
        "null",
        "hybrid",
        "refresh",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "url https",
        "tulach type",
        "role title",
        "added active",
        "pulses url",
        "url http",
        "nextc type",
        "type indicator",
        "related pulses",
        "filehashsha256",
        "copyright",
        "ipv6",
        "germany",
        "italy",
        "trojan",
        "trojanspy",
        "worm",
        "trojanclicker",
        "virtool",
        "service",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "collisionbox",
        "runner",
        "gameoverpanel",
        "trex",
        "orgtechhandle",
        "orgtechref",
        "director",
        "university",
        "nethandle",
        "net168",
        "net1680000",
        "ucha",
        "orgid",
        "east",
        "report spam",
        "as8075",
        "servers",
        "secure server",
        "error all",
        "typeof",
        "error f",
        "crazy doll",
        "created",
        "filehashmd5",
        "types of",
        "russia",
        "emotet type",
        "mirai type",
        "mirai",
        "mtb description",
        "win32 type",
        "as31034 aruba",
        "italy unknown",
        "as19527 google",
        "encrypt",
        "health type",
        "miori hackers",
        "brute force",
        "backdoor",
        "aurora",
        "ip address",
        "path",
        "unis",
        "dotcisoffer",
        "bladabindi",
        "artro",
        "script urls",
        "as46606",
        "brazil unknown",
        "as11284",
        "as10906",
        "apache",
        "lanc type",
        "telper",
        "win32",
        "win64",
        "pulses email",
        "as9009 m247",
        "as7296 alchemy",
        "as14061",
        "as16276",
        "trojandropper",
        "ransom",
        "mtb sep",
        "msie",
        "chrome",
        "ip check",
        "gmt content",
        "pulse submit",
        "url analysis",
        "files ip",
        "aaaa nxdomain",
        "nxdomain",
        "a nxdomain",
        "as22612",
        "dnssec",
        "meta http",
        "accept encoding",
        "request id",
        "united kingdom",
        "div div",
        "arial helvetica",
        "emails",
        "as15169 google",
        "cryp",
        "gmt cache",
        "sameorigin",
        "domain name",
        "code",
        "false",
        "command type",
        "roleselfservice",
        "mcig sep",
        "all search",
        "author avatar",
        "days ago",
        "http",
        "related nids",
        "files location",
        "as30081",
        "gmt contenttype",
        "mozilla",
        "as15133 verizon",
        "whitelisted",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "softcnapp",
        "overview ip",
        "flag united",
        "files related",
        "as62597 nsone",
        "as31898 oracle",
        "mtb aug",
        "class",
        "twitter",
        "april",
        "secure",
        "httponly",
        "expiresthu",
        "pragma",
        "as13414 twitter",
        "smoke loader",
        "reverse dns",
        "asnone united",
        "idlogin sep",
        "uid38009",
        "expiration",
        "hack type",
        "porn type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Aruba"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66fc29a49b5ac693c8d75122",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3851,
        "FileHash-MD5": 6012,
        "FileHash-SHA1": 5906,
        "domain": 3330,
        "email": 33,
        "hostname": 4231,
        "CVE": 2,
        "FileHash-SHA256": 8407,
        "CIDR": 2,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 31781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "1 day ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f2dc7db0bb5c5cdaec5a6c",
      "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
      "description": "",
      "modified": "2026-04-30T04:53:09.713000",
      "created": "2026-04-30T04:37:17.546000",
      "tags": [
        "united",
        "as397240",
        "search",
        "showing",
        "as54113",
        "as397241",
        "unknown",
        "moved",
        "creation date",
        "record value",
        "next",
        "date",
        "body",
        "a domains",
        "passive dns",
        "formbook cnc",
        "checkin",
        "entries",
        "github pages",
        "sea x",
        "accept",
        "status",
        "name servers",
        "certificate",
        "urls",
        "aaaa",
        "cname",
        "meta",
        "whitelisted ip",
        "address",
        "location united",
        "asn as36459",
        "github",
        "less whois",
        "registrar",
        "markmonitor",
        "related tags",
        "as36459",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "ninite",
        "expiration date",
        "domain",
        "hostname",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "document file",
        "v2 document",
        "utf8",
        "crlf line",
        "beginstring",
        "size",
        "null",
        "hybrid",
        "refresh",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "url https",
        "tulach type",
        "role title",
        "added active",
        "pulses url",
        "url http",
        "nextc type",
        "type indicator",
        "related pulses",
        "filehashsha256",
        "copyright",
        "ipv6",
        "germany",
        "italy",
        "trojan",
        "trojanspy",
        "worm",
        "trojanclicker",
        "virtool",
        "service",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "collisionbox",
        "runner",
        "gameoverpanel",
        "trex",
        "orgtechhandle",
        "orgtechref",
        "director",
        "university",
        "nethandle",
        "net168",
        "net1680000",
        "ucha",
        "orgid",
        "east",
        "report spam",
        "as8075",
        "servers",
        "secure server",
        "error all",
        "typeof",
        "error f",
        "crazy doll",
        "created",
        "filehashmd5",
        "types of",
        "russia",
        "emotet type",
        "mirai type",
        "mirai",
        "mtb description",
        "win32 type",
        "as31034 aruba",
        "italy unknown",
        "as19527 google",
        "encrypt",
        "health type",
        "miori hackers",
        "brute force",
        "backdoor",
        "aurora",
        "ip address",
        "path",
        "unis",
        "dotcisoffer",
        "bladabindi",
        "artro",
        "script urls",
        "as46606",
        "brazil unknown",
        "as11284",
        "as10906",
        "apache",
        "lanc type",
        "telper",
        "win32",
        "win64",
        "pulses email",
        "as9009 m247",
        "as7296 alchemy",
        "as14061",
        "as16276",
        "trojandropper",
        "ransom",
        "mtb sep",
        "msie",
        "chrome",
        "ip check",
        "gmt content",
        "pulse submit",
        "url analysis",
        "files ip",
        "aaaa nxdomain",
        "nxdomain",
        "a nxdomain",
        "as22612",
        "dnssec",
        "meta http",
        "accept encoding",
        "request id",
        "united kingdom",
        "div div",
        "arial helvetica",
        "emails",
        "as15169 google",
        "cryp",
        "gmt cache",
        "sameorigin",
        "domain name",
        "code",
        "false",
        "command type",
        "roleselfservice",
        "mcig sep",
        "all search",
        "author avatar",
        "days ago",
        "http",
        "related nids",
        "files location",
        "as30081",
        "gmt contenttype",
        "mozilla",
        "as15133 verizon",
        "whitelisted",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "softcnapp",
        "overview ip",
        "flag united",
        "files related",
        "as62597 nsone",
        "as31898 oracle",
        "mtb aug",
        "class",
        "twitter",
        "april",
        "secure",
        "httponly",
        "expiresthu",
        "pragma",
        "as13414 twitter",
        "smoke loader",
        "reverse dns",
        "asnone united",
        "idlogin sep",
        "uid38009",
        "expiration",
        "hack type",
        "porn type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Aruba"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66fc29a49b5ac693c8d75122",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3851,
        "FileHash-MD5": 6012,
        "FileHash-SHA1": 5906,
        "domain": 3330,
        "email": 33,
        "hostname": 4231,
        "CVE": 2,
        "FileHash-SHA256": 8407,
        "CIDR": 2,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 31781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "31 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66fc29a49b5ac693c8d75122",
      "name": "Medical Campus - Aurora, Co | Recheck",
      "description": "This weekend we found a busybox MIORI Hackers - serious attack Aurora, Medical Campus -Mirai. This recheck is generic. All results generated automatically by LevelBlue, sourced by ScoreBlue.\nMaybe it will be clean today. Complaints of pop up auto logins on locked screens and autonomous system running alongside actual system. System root.\nMalware Families:\nTrojanDownloader:Win32/Bulilit, ELF:Mirai-TO\\ [Trj], Backdoor:Linux/Mirai.B, TELPER:HSTR:DotCisOffer, TrojanSpy:Win32/Nivdort, Backdoor:Win32/Bladabindi, ALF:E5, Win.Malware.Midie-9950743-0, Trojan:Win32/Emotet.ARJ!MTB",
      "modified": "2024-10-31T16:03:52.240000",
      "created": "2024-10-01T16:56:04.004000",
      "tags": [
        "united",
        "as397240",
        "search",
        "showing",
        "as54113",
        "as397241",
        "unknown",
        "moved",
        "creation date",
        "record value",
        "next",
        "date",
        "body",
        "a domains",
        "passive dns",
        "formbook cnc",
        "checkin",
        "entries",
        "github pages",
        "sea x",
        "accept",
        "status",
        "name servers",
        "certificate",
        "urls",
        "aaaa",
        "cname",
        "meta",
        "whitelisted ip",
        "address",
        "location united",
        "asn as36459",
        "github",
        "less whois",
        "registrar",
        "markmonitor",
        "related tags",
        "as36459",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "ninite",
        "expiration date",
        "domain",
        "hostname",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "document file",
        "v2 document",
        "utf8",
        "crlf line",
        "beginstring",
        "size",
        "null",
        "hybrid",
        "refresh",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "url https",
        "tulach type",
        "role title",
        "added active",
        "pulses url",
        "url http",
        "nextc type",
        "type indicator",
        "related pulses",
        "filehashsha256",
        "copyright",
        "ipv6",
        "germany",
        "italy",
        "trojan",
        "trojanspy",
        "worm",
        "trojanclicker",
        "virtool",
        "service",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "collisionbox",
        "runner",
        "gameoverpanel",
        "trex",
        "orgtechhandle",
        "orgtechref",
        "director",
        "university",
        "nethandle",
        "net168",
        "net1680000",
        "ucha",
        "orgid",
        "east",
        "report spam",
        "as8075",
        "servers",
        "secure server",
        "error all",
        "typeof",
        "error f",
        "crazy doll",
        "created",
        "filehashmd5",
        "types of",
        "russia",
        "emotet type",
        "mirai type",
        "mirai",
        "mtb description",
        "win32 type",
        "as31034 aruba",
        "italy unknown",
        "as19527 google",
        "encrypt",
        "health type",
        "miori hackers",
        "brute force",
        "backdoor",
        "aurora",
        "ip address",
        "path",
        "unis",
        "dotcisoffer",
        "bladabindi",
        "artro",
        "script urls",
        "as46606",
        "brazil unknown",
        "as11284",
        "as10906",
        "apache",
        "lanc type",
        "telper",
        "win32",
        "win64",
        "pulses email",
        "as9009 m247",
        "as7296 alchemy",
        "as14061",
        "as16276",
        "trojandropper",
        "ransom",
        "mtb sep",
        "msie",
        "chrome",
        "ip check",
        "gmt content",
        "pulse submit",
        "url analysis",
        "files ip",
        "aaaa nxdomain",
        "nxdomain",
        "a nxdomain",
        "as22612",
        "dnssec",
        "meta http",
        "accept encoding",
        "request id",
        "united kingdom",
        "div div",
        "arial helvetica",
        "emails",
        "as15169 google",
        "cryp",
        "gmt cache",
        "sameorigin",
        "domain name",
        "code",
        "false",
        "command type",
        "roleselfservice",
        "mcig sep",
        "all search",
        "author avatar",
        "days ago",
        "http",
        "related nids",
        "files location",
        "as30081",
        "gmt contenttype",
        "mozilla",
        "as15133 verizon",
        "whitelisted",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "softcnapp",
        "overview ip",
        "flag united",
        "files related",
        "as62597 nsone",
        "as31898 oracle",
        "mtb aug",
        "class",
        "twitter",
        "april",
        "secure",
        "httponly",
        "expiresthu",
        "pragma",
        "as13414 twitter",
        "smoke loader",
        "reverse dns",
        "asnone united",
        "idlogin sep",
        "uid38009",
        "expiration",
        "hack type",
        "porn type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Aruba"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 53,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3850,
        "FileHash-MD5": 6012,
        "FileHash-SHA1": 5906,
        "domain": 3329,
        "email": 33,
        "hostname": 4231,
        "CVE": 2,
        "FileHash-SHA256": 8407,
        "CIDR": 2,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 31779,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 236,
      "modified_text": "576 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "659b4cea3e6da3a00306ae11",
      "name": "Ragnar Locker | Cowrie Hash",
      "description": "Cowrie is a medium interaction SSH and Telnet honeypot designed to log brute force attacks and shell interaction performed by an attacker. Cowrie also functions as an SSH and telnet proxy to observe attacker behavior to another system. Cowrie was developed from Kippo.\n\nRagnar Locker: \nAffected platforms: Microsoft Windows\nImpacted parties: Microsoft Windows  & Linux Users\nImpact: Encrypts files on the compromised machine and demands ransom for file decryption\nSeverity level: High\n\nI'm not sure. It seems this 'Law' group aquires and sell your digital profiles, PHI. PII, Banking , Insurance credentials on the dark web.",
      "modified": "2024-02-06T23:04:54.022000",
      "created": "2024-01-08T01:16:26.884000",
      "tags": [
        "contacted",
        "pe resource",
        "execution",
        "problems",
        "alienvault part",
        "dropped",
        "kgs0",
        "kls0",
        "collections",
        "schema abuse",
        "iframe",
        "united",
        "as29791",
        "search",
        "entries",
        "passive dns",
        "urls",
        "service",
        "date",
        "unknown",
        "japan unknown",
        "body",
        "czechia unknown",
        "sinkhole",
        "emotet",
        "date hash",
        "avast avg",
        "mtb dec",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "samples",
        "tulach",
        "tulach.cc",
        "sabey data center",
        "malware server",
        "gorf",
        "set cookie",
        "united kingdom",
        "script urls",
        "trojan",
        "status",
        "showing",
        "cookie",
        "template",
        "johnnsabey",
        "briansabey",
        "data center",
        "choco",
        "name",
        "win32 exe",
        "domains",
        "registrar",
        "markmonitor inc",
        "ip detections",
        "country",
        "us execution",
        "parents",
        "whois record",
        "whois whois",
        "ssl certificate",
        "apple ios",
        "red team",
        "tsara brashears",
        "historical ssl",
        "hacktool",
        "copy",
        "malicious",
        "life",
        "unsafe",
        "server",
        "registrar abuse",
        "contact phone",
        "domain status",
        "registrar whois",
        "email",
        "registry domain",
        "registry expiry",
        "algorithm",
        "v3 serial",
        "number",
        "issuer",
        "key algorithm",
        "ec oid",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "info",
        "first",
        "http method",
        "http requests",
        "connect http",
        "get dns",
        "resolutions",
        "ip traffic",
        "intel",
        "ms windows",
        "write c",
        "pe32",
        "pe32 executable",
        "copy c",
        "show",
        "free",
        "recon",
        "benjamin",
        "write",
        "worm",
        "win32",
        "june",
        "delphi",
        "code",
        "malware",
        "next",
        "using",
        "urls http",
        "benjamin",
        "nids",
        "cowrie hashes",
        "dns replication",
        "files",
        "sample",
        "sender",
        "us postal",
        "cowrie",
        "iranian actor",
        "shipping",
        "healthcare",
        "ragnar locker",
        "qakbot",
        "qbot",
        "pii",
        "phi",
        "privacy",
        "honeypot",
        "referrer",
        "spyware",
        "android",
        "nanocore",
        "banker",
        "keylogger"
      ],
      "references": [
        "choco.exe",
        "media-router-fp74.prod.media.vip.bf1.yahoo.com",
        "https://www.cybereason.com/blog/threat-analysis-report-ragnar-locker-ransomware-targeting-the-energy-sector?hs_amp=true",
        "httphttp://security.didici.cc/cves://www.sentinelone.com/anthology/ragnar-locker/",
        "http://security.didici.cc/cve",
        "https://whois.domaintools.com/gov1.info",
        "https://nsa.gov1.info/utah-data-center/",
        "https://github.com/cowrie/cowrie",
        "Cowrie (honeypot) - Wikipedia",
        "https://www.fortinet.com/blog/threat-research/ransomware-roundup-ragnar-locker-ransomware"
      ],
      "public": 1,
      "adversary": "Ragnar Locker | M. Brian Sabey | HallRender| Tulach | Benjamin",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "ALF:Win32/GbdInf_123DF591.J!ibt",
          "display_name": "ALF:Win32/GbdInf_123DF591.J!ibt",
          "target": "/malware/ALF:Win32/GbdInf_123DF591.J!ibt"
        },
        {
          "id": "SABEY",
          "display_name": "SABEY",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/Cassini_f28c33a2!ibt",
          "display_name": "ALF:Trojan:Win32/Cassini_f28c33a2!ibt",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/Cassini_ade36583!ibt",
          "display_name": "ALF:Trojan:Win32/Cassini_ade36583!ibt",
          "target": null
        },
        {
          "id": "ALF:Ransom:Win32/Babax.SG!MTB",
          "display_name": "ALF:Ransom:Win32/Babax.SG!MTB",
          "target": null
        },
        {
          "id": "ALF:SpikeAexR.SECTHDR",
          "display_name": "ALF:SpikeAexR.SECTHDR",
          "target": null
        },
        {
          "id": "ALF:Trojan:MSIL/AgentTesla.KM",
          "display_name": "ALF:Trojan:MSIL/AgentTesla.KM",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker ,   ,  ALF:Trojan:Win32/AutoRun.PI!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker ,   ,  ALF:Trojan:Win32/AutoRun.PI!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Ransom:MSIL/Gorf",
          "display_name": "ALF:HeraklezEval:Ransom:MSIL/Gorf",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "Qbot",
          "display_name": "Qbot",
          "target": null
        },
        {
          "id": "Ragnar Locker",
          "display_name": "Ragnar Locker",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Trojan",
          "display_name": "Trojan",
          "target": null
        },
        {
          "id": "Worm",
          "display_name": "Worm",
          "target": null
        },
        {
          "id": "NanCore RAY",
          "display_name": "NanCore RAY",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [
        "Healthcare",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 347,
        "FileHash-SHA1": 222,
        "FileHash-SHA256": 6645,
        "hostname": 2744,
        "URL": 9123,
        "domain": 3065,
        "email": 4
      },
      "indicator_count": 22150,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "844 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "659261d5965b4824d1606cf9",
      "name": "Pegasus - a-poster.info",
      "description": "",
      "modified": "2024-01-31T04:00:35.757000",
      "created": "2024-01-01T06:55:17.262000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "ipv4",
        "expiration",
        "iocs",
        "ipv6",
        "url http",
        "url https",
        "next",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "cidr",
        "pcap",
        "stix",
        "subid",
        "mtsub26293293",
        "dashboard",
        "browse scan",
        "endpoints all",
        "octoseek",
        "a poster",
        "apple",
        "apple id",
        "apple engineering",
        "icloud",
        "tulach",
        "hallrender",
        "ck matrix",
        "ck id",
        "xobo",
        "a nxdomain",
        "sabey",
        "aaaa",
        "win32",
        "briansabey",
        "brian",
        "brian sabey",
        "urls https",
        "unknown urls",
        "united",
        "ttl value",
        "tsara brashears",
        "trojan",
        "tracker",
        "tofsee",
        "threat analyzer",
        "threat",
        "temp",
        "teams api",
        "subdomains",
        "active",
        "active threat",
        "strings",
        "status codes",
        "japan national police agency",
        "pegasus",
        "china",
        "aig",
        "ssl certificate",
        "accept",
        "ssh on server",
        "speakez securus",
        "show technique",
        "https",
        "relay",
        "state",
        "android",
        "address",
        "aposter",
        "workaposter",
        "sha256",
        "showing",
        "simple",
        "span",
        "small",
        "serving ip",
        "script",
        "search",
        "root",
        "ca",
        "samples",
        "root ca",
        "resolutions",
        "remote",
        "relay",
        "relacion",
        "referrer",
        "record value",
        "applenoc",
        "as16625",
        "attack",
        "apple attack",
        "bundled",
        "canvas",
        "mitre attk",
        "brute force passwords",
        "body length",
        "body",
        "backdoor",
        "bellsouth",
        "bahamut",
        "bell south",
        "mitre",
        "cellbrite",
        "class",
        "click",
        "authority",
        "contentencoding",
        "akamai",
        "as20940",
        "as24940 hetzner",
        "as58061 scalaxy",
        "scalaxy",
        "as714",
        "critical",
        "communicating",
        "quasar",
        "trojan",
        "et",
        "icefog",
        "pegasus",
        "tofsee",
        "cmd",
        "crypto",
        "error",
        "dns replication",
        "domain entries",
        "et cins",
        "execution",
        "cname",
        "config",
        "contact",
        "contacted",
        "copy",
        "creation date",
        "formbook",
        "jekyll",
        "graph",
        "germany unknown",
        "generator",
        "general",
        "forbidden",
        "falcon sandbox",
        "ssl hostname",
        "false",
        "file",
        "final url",
        "final url summary",
        "hashes files",
        "headers nel",
        "historical",
        "malicious host",
        "malvertizing",
        "malware",
        "tagging",
        "contextualizing",
        "localappdata",
        "install",
        "installer",
        "ioc search",
        "iocs kb",
        "body",
        "local",
        "United states",
        "name",
        "name servers",
        "mitre att",
        "metro",
        "meta",
        "mail spammer",
        "submit",
        "submit quasar",
        "phishing",
        "pattern match",
        "paste",
        "passive dns",
        "nxdomain",
        "national police agency japan",
        "network",
        "verdict",
        "cmd",
        "sandbox",
        "http response",
        "record type",
        "phishing",
        "nuance",
        "next",
        "new ioc",
        "subdomains",
        "germany",
        "reinsurance",
        "nuance",
        "cybercrime",
        "tracking",
        "cyber stalking",
        "fear",
        "masquerading",
        "cobalt strike"
      ],
      "references": [
        "a-poster.info",
        "https://tulach.cc/",
        "images.ctfassets.net",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "nr-data.net [Apple Private Data Collection]",
        "http://gmpg.org/xfn/11 [HTTrack]",
        "192.229.211.108 [Tracking & Virus Network]",
        "me.com [Pegasus]",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "37.1.217.172 [scanning host]",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "IceFog",
          "display_name": "IceFog",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Pegasus for iOS - S0289",
          "display_name": "Pegasus for iOS - S0289",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Trojan",
          "display_name": "Trojan",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Appleservice",
          "display_name": "Appleservice",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 41,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4719,
        "domain": 2497,
        "hostname": 3549,
        "FileHash-MD5": 4118,
        "FileHash-SHA1": 3496,
        "FileHash-SHA256": 5861,
        "CIDR": 12,
        "email": 17
      },
      "indicator_count": 24269,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "659261e2290ac1ecc5d9ca74",
      "name": "Pegasus - a-poster.info",
      "description": "",
      "modified": "2024-01-31T04:00:35.757000",
      "created": "2024-01-01T06:55:30.771000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "ipv4",
        "expiration",
        "iocs",
        "ipv6",
        "url http",
        "url https",
        "next",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "cidr",
        "pcap",
        "stix",
        "subid",
        "mtsub26293293",
        "dashboard",
        "browse scan",
        "endpoints all",
        "octoseek",
        "a poster",
        "apple",
        "apple id",
        "apple engineering",
        "icloud",
        "tulach",
        "hallrender",
        "ck matrix",
        "ck id",
        "xobo",
        "a nxdomain",
        "sabey",
        "aaaa",
        "win32",
        "briansabey",
        "brian",
        "brian sabey",
        "urls https",
        "unknown urls",
        "united",
        "ttl value",
        "tsara brashears",
        "trojan",
        "tracker",
        "tofsee",
        "threat analyzer",
        "threat",
        "temp",
        "teams api",
        "subdomains",
        "active",
        "active threat",
        "strings",
        "status codes",
        "japan national police agency",
        "pegasus",
        "china",
        "aig",
        "ssl certificate",
        "accept",
        "ssh on server",
        "speakez securus",
        "show technique",
        "https",
        "relay",
        "state",
        "android",
        "address",
        "aposter",
        "workaposter",
        "sha256",
        "showing",
        "simple",
        "span",
        "small",
        "serving ip",
        "script",
        "search",
        "root",
        "ca",
        "samples",
        "root ca",
        "resolutions",
        "remote",
        "relay",
        "relacion",
        "referrer",
        "record value",
        "applenoc",
        "as16625",
        "attack",
        "apple attack",
        "bundled",
        "canvas",
        "mitre attk",
        "brute force passwords",
        "body length",
        "body",
        "backdoor",
        "bellsouth",
        "bahamut",
        "bell south",
        "mitre",
        "cellbrite",
        "class",
        "click",
        "authority",
        "contentencoding",
        "akamai",
        "as20940",
        "as24940 hetzner",
        "as58061 scalaxy",
        "scalaxy",
        "as714",
        "critical",
        "communicating",
        "quasar",
        "trojan",
        "et",
        "icefog",
        "pegasus",
        "tofsee",
        "cmd",
        "crypto",
        "error",
        "dns replication",
        "domain entries",
        "et cins",
        "execution",
        "cname",
        "config",
        "contact",
        "contacted",
        "copy",
        "creation date",
        "formbook",
        "jekyll",
        "graph",
        "germany unknown",
        "generator",
        "general",
        "forbidden",
        "falcon sandbox",
        "ssl hostname",
        "false",
        "file",
        "final url",
        "final url summary",
        "hashes files",
        "headers nel",
        "historical",
        "malicious host",
        "malvertizing",
        "malware",
        "tagging",
        "contextualizing",
        "localappdata",
        "install",
        "installer",
        "ioc search",
        "iocs kb",
        "body",
        "local",
        "United states",
        "name",
        "name servers",
        "mitre att",
        "metro",
        "meta",
        "mail spammer",
        "submit",
        "submit quasar",
        "phishing",
        "pattern match",
        "paste",
        "passive dns",
        "nxdomain",
        "national police agency japan",
        "network",
        "verdict",
        "cmd",
        "sandbox",
        "http response",
        "record type",
        "phishing",
        "nuance",
        "next",
        "new ioc",
        "subdomains",
        "germany",
        "reinsurance",
        "nuance",
        "cybercrime",
        "tracking",
        "cyber stalking",
        "fear",
        "masquerading",
        "cobalt strike"
      ],
      "references": [
        "a-poster.info",
        "https://tulach.cc/",
        "images.ctfassets.net",
        "https://www.pornhub.com/video/search?search=tsara+brashears [Apple Password Cracker]",
        "nr-data.net [Apple Private Data Collection]",
        "http://gmpg.org/xfn/11 [HTTrack]",
        "192.229.211.108 [Tracking & Virus Network]",
        "me.com [Pegasus]",
        "contact_pki@apple.com [CAA mail contact] [17.253.142.4 Apple CAA IP]",
        "37.1.217.172 [scanning host]",
        "https://www.virustotal.com/gui/domain/paypal-secure-id-login-webobjects-support-home.e-pornosex.com/community"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "IceFog",
          "display_name": "IceFog",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Pegasus for iOS - S0289",
          "display_name": "Pegasus for iOS - S0289",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Trojan",
          "display_name": "Trojan",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Appleservice",
          "display_name": "Appleservice",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4695,
        "domain": 2494,
        "hostname": 3547,
        "FileHash-MD5": 4118,
        "FileHash-SHA1": 3496,
        "FileHash-SHA256": 5841,
        "CIDR": 12,
        "email": 17
      },
      "indicator_count": 24220,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "851 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "turingtech.co",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "turingtech.co",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780211831.934961
}