{
  "type": "Domain",
  "indicator": "vodeoapi.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/vodeoapi.com",
    "alexa": "http://www.alexa.com/siteinfo/vodeoapi.com",
    "indicator": "vodeoapi.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3833533557,
      "indicator": "vodeoapi.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbe07f0780cef1c48ccae4",
          "name": "access.blackbagtech.com",
          "description": "innovative forensic acquisition, triage, and analysis software for Windows, Android, iPhone/iPad, and Mac OS X devices.\nIn this instance Pegasus was deployed against the survivor of hungry, injurious SA against Brashears; allegedly assaulted by PT Jeffrey Reimer in AMS Concentra/Select Physical Therapy in  Denver, Co. Rather than investigate DPT Reimer, law enforcement launched attack against victim ( SCI/TBI). Brashears was threatened by Mark Montana MD, lawyer and Workers Compensation doctor. Denied care, equally aggressive Montano wage effort to ensure silence and wides bid for Douglas County, Colorado Coroner election. Fraud, framing, death threats ensued. Montano threatened Brashears with his alleged best friend Tony Spurlock, promising a battle against her  Court documented. \nBrashears is in danger.",
          "modified": "2024-03-02T17:02:51.870000",
          "created": "2024-02-01T18:18:39.156000",
          "tags": [
            "ssl certificate",
            "whois record",
            "pegasus",
            "cellbrite",
            "targets sa",
            "survivor",
            "blackbag",
            "relations apple",
            "mdm hacking",
            "communicating",
            "execution",
            "contacted",
            "quasar",
            "kgs0",
            "malware",
            "core",
            "hacktool",
            "ransomexx",
            "azorult",
            "emotet",
            "remcos",
            "agent tesla",
            "grandoreiro",
            "targeting tsara brashears",
            "delphi programming",
            "access",
            "local law enforcement",
            "quasi case",
            "framing",
            "jeffrey reimer dpt 'reported' assaulter",
            "state and governments cover white offender jeffrey reimer",
            "indian mix brashears physically attacked often followed",
            "death threats",
            "alienvault results removed from search results",
            "brashears tagged in adult content - not removed",
            "brashears blacklisted",
            "reimer promoted",
            "false criminal records created about brashears",
            "brashears family identity theft",
            "judge sided with brashears",
            "brashears given less than $10000 by Brian sabey",
            "brian sabey constant contact ) threats",
            "brashears stalked",
            "reimer protected and hidden",
            "pegasus technology disallows victim to report to regulatory boar",
            "aig",
            "industry and commerce",
            "danger",
            "rob neill drives brashears off road",
            "brashears further injured",
            "neill positively identified - no charges",
            "malvertizing",
            "botnet",
            "fraud apple support chats",
            "falsified medical records",
            "denied healthcare",
            "hydrocephalus not disclosed",
            "permanent damage",
            "corruption",
            "burg simpson corruption",
            "Denver trial attorneys tell brashears statute is 6 years in colo",
            "da informs brashears no statute",
            "brashears denied disability benefits for years",
            "remember george floyd? brashears survived that injury",
            "brashears cannot digest food",
            "brashears can't toilet",
            "jeffrey reimer was reported early",
            "brashears bullied to return to PT due to workers compensation ru",
            "montano threatened brashears with breaking the law if not return",
            "reimer recorded",
            "recordings stored  online",
            "recordings retrieved by bgp",
            "bryan counts made aware of recordings",
            "recordings demanded",
            "america?",
            "advocates ensure the rights of others",
            "make others aware",
            "who else is unheard.",
            "non stop harassment",
            "constant car bomb threats",
            "brashears unable to properly articulate",
            "nothing new",
            "assaulted by man demanding phone",
            "no charges",
            "Brian sabey brings case to silence brashears",
            "sabey motions dismissed",
            "pegasus involves malicious actions by humans",
            "pegasus attackers do kill",
            "pegasus attackers make in person contact",
            "overly large campaign",
            "private investigators tailed stalkers. became afraid when learni",
            "discrimination",
            "hacking",
            "tracking",
            "car hacking",
            "apple",
            "android overlay",
            "network rats",
            "brashears denied vocational rehab twice",
            "brashears unhirable due to online profile",
            "employer rightfully consider brashears attack a risk to others",
            "group hacked intermountain healthcare",
            "group hacked uchealth colorado",
            "group hacked esurance"
          ],
          "references": [
            "access.blackbagtech.com",
            "The only thing necessary for the triumph of evil is for good men to do nothing.\u201d"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 87,
            "FileHash-SHA1": 78,
            "FileHash-SHA256": 2075,
            "URL": 2696,
            "domain": 710,
            "hostname": 827,
            "CVE": 1
          },
          "indicator_count": 6474,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "access.blackbagtech.com",
        "The only thing necessary for the triumph of evil is for good men to do nothing.\u201d"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "NSO Group"
          ],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbe07f0780cef1c48ccae4",
      "name": "access.blackbagtech.com",
      "description": "innovative forensic acquisition, triage, and analysis software for Windows, Android, iPhone/iPad, and Mac OS X devices.\nIn this instance Pegasus was deployed against the survivor of hungry, injurious SA against Brashears; allegedly assaulted by PT Jeffrey Reimer in AMS Concentra/Select Physical Therapy in  Denver, Co. Rather than investigate DPT Reimer, law enforcement launched attack against victim ( SCI/TBI). Brashears was threatened by Mark Montana MD, lawyer and Workers Compensation doctor. Denied care, equally aggressive Montano wage effort to ensure silence and wides bid for Douglas County, Colorado Coroner election. Fraud, framing, death threats ensued. Montano threatened Brashears with his alleged best friend Tony Spurlock, promising a battle against her  Court documented. \nBrashears is in danger.",
      "modified": "2024-03-02T17:02:51.870000",
      "created": "2024-02-01T18:18:39.156000",
      "tags": [
        "ssl certificate",
        "whois record",
        "pegasus",
        "cellbrite",
        "targets sa",
        "survivor",
        "blackbag",
        "relations apple",
        "mdm hacking",
        "communicating",
        "execution",
        "contacted",
        "quasar",
        "kgs0",
        "malware",
        "core",
        "hacktool",
        "ransomexx",
        "azorult",
        "emotet",
        "remcos",
        "agent tesla",
        "grandoreiro",
        "targeting tsara brashears",
        "delphi programming",
        "access",
        "local law enforcement",
        "quasi case",
        "framing",
        "jeffrey reimer dpt 'reported' assaulter",
        "state and governments cover white offender jeffrey reimer",
        "indian mix brashears physically attacked often followed",
        "death threats",
        "alienvault results removed from search results",
        "brashears tagged in adult content - not removed",
        "brashears blacklisted",
        "reimer promoted",
        "false criminal records created about brashears",
        "brashears family identity theft",
        "judge sided with brashears",
        "brashears given less than $10000 by Brian sabey",
        "brian sabey constant contact ) threats",
        "brashears stalked",
        "reimer protected and hidden",
        "pegasus technology disallows victim to report to regulatory boar",
        "aig",
        "industry and commerce",
        "danger",
        "rob neill drives brashears off road",
        "brashears further injured",
        "neill positively identified - no charges",
        "malvertizing",
        "botnet",
        "fraud apple support chats",
        "falsified medical records",
        "denied healthcare",
        "hydrocephalus not disclosed",
        "permanent damage",
        "corruption",
        "burg simpson corruption",
        "Denver trial attorneys tell brashears statute is 6 years in colo",
        "da informs brashears no statute",
        "brashears denied disability benefits for years",
        "remember george floyd? brashears survived that injury",
        "brashears cannot digest food",
        "brashears can't toilet",
        "jeffrey reimer was reported early",
        "brashears bullied to return to PT due to workers compensation ru",
        "montano threatened brashears with breaking the law if not return",
        "reimer recorded",
        "recordings stored  online",
        "recordings retrieved by bgp",
        "bryan counts made aware of recordings",
        "recordings demanded",
        "america?",
        "advocates ensure the rights of others",
        "make others aware",
        "who else is unheard.",
        "non stop harassment",
        "constant car bomb threats",
        "brashears unable to properly articulate",
        "nothing new",
        "assaulted by man demanding phone",
        "no charges",
        "Brian sabey brings case to silence brashears",
        "sabey motions dismissed",
        "pegasus involves malicious actions by humans",
        "pegasus attackers do kill",
        "pegasus attackers make in person contact",
        "overly large campaign",
        "private investigators tailed stalkers. became afraid when learni",
        "discrimination",
        "hacking",
        "tracking",
        "car hacking",
        "apple",
        "android overlay",
        "network rats",
        "brashears denied vocational rehab twice",
        "brashears unhirable due to online profile",
        "employer rightfully consider brashears attack a risk to others",
        "group hacked intermountain healthcare",
        "group hacked uchealth colorado",
        "group hacked esurance"
      ],
      "references": [
        "access.blackbagtech.com",
        "The only thing necessary for the triumph of evil is for good men to do nothing.\u201d"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 87,
        "FileHash-SHA1": 78,
        "FileHash-SHA256": 2075,
        "URL": 2696,
        "domain": 710,
        "hostname": 827,
        "CVE": 1
      },
      "indicator_count": 6474,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "778 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "vodeoapi.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "vodeoapi.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641930.2691314
}