{
  "type": "Domain",
  "indicator": "zigqnx.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/zigqnx.com",
    "alexa": "http://www.alexa.com/siteinfo/zigqnx.com",
    "indicator": "zigqnx.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3332274551,
      "indicator": "zigqnx.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 14,
      "pulses": [
        {
          "id": "69aa0a62f94a92b5168405c2",
          "name": "fedpaypal clone Q vashti",
          "description": "",
          "modified": "2026-03-06T06:39:27.872000",
          "created": "2026-03-05T22:57:38.559000",
          "tags": [
            "present sep",
            "virtool",
            "cryp",
            "win32",
            "ip address",
            "trojan",
            "ransom",
            "asn as54113",
            "passive dns",
            "msil",
            "united states",
            "dynamicloader",
            "qaeaav12",
            "high",
            "qbeipbdii",
            "write",
            "paypal",
            "medium",
            "search",
            "vmware",
            "floodfix",
            "malware",
            "united",
            "mtb apr",
            "hostname add",
            "write c",
            "read c",
            "yara detections",
            "upxoepplace",
            "next",
            "markus",
            "april",
            "ping",
            "meta http",
            "content",
            "gmt server",
            "th th",
            "443 ma2592000",
            "ipv4 add",
            "url analysis",
            "urls",
            "body",
            "title",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "t1590 gather",
            "victim network",
            "status",
            "name servers",
            "set cookie",
            "script urls",
            "present feb",
            "cookie",
            "template",
            "present oct",
            "present jul",
            "present dec",
            "present jun",
            "next associated",
            "urls show",
            "date checked",
            "present apr",
            "url hostname",
            "united kingdom",
            "unknown ns",
            "servers",
            "great britain",
            "msr aug",
            "msr apr",
            "msr nov",
            "ite o",
            "server response",
            "script script",
            "files show",
            "date hash",
            "avast avg",
            "creation date",
            "lcid1033",
            "sminnotek",
            "spnvirtualbox",
            "bvvirtualbox",
            "present mar",
            "present nov",
            "exploit",
            "error",
            "server response",
            "google safe",
            "results sep",
            "backdoor",
            "certificate",
            "mtb sep",
            "next http",
            "scans show",
            "present may",
            "results jun",
            "results jan",
            "worm",
            "echo request",
            "sweep",
            "payload hello",
            "world",
            "ids detections",
            "cape",
            "viking",
            "philis",
            "et",
            "torop",
            "des moines",
            "contacted hosts",
            "content reputation",
            "sabey type",
            "tulach type",
            "rexx type",
            "foundry type",
            "fred scherr",
            "twitter",
            "apple",
            "monitored target",
            "financial theft",
            "psalms 27: 1 - 14"
          ],
          "references": [
            "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]",
            "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com",
            "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368",
            "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com",
            "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/",
            "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/",
            "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/",
            "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1",
            "https://twitter.com/PORNO_SEXYBABES \u2022  https://megapornfreehd.com/2025/04/360",
            "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32:MalOb-BX\\ [Cryp]",
              "display_name": "Win32:MalOb-BX\\ [Cryp]",
              "target": null
            },
            {
              "id": "Win.Trojan.Fraudpack",
              "display_name": "Win.Trojan.Fraudpack",
              "target": null
            },
            {
              "id": "Fakeav",
              "display_name": "Fakeav",
              "target": null
            },
            {
              "id": "Ransom:MSIL/Genasom.I",
              "display_name": "Ransom:MSIL/Genasom.I",
              "target": "/malware/Ransom:MSIL/Genasom.I"
            },
            {
              "id": "Virtool:Win32/Obfuscator.KI",
              "display_name": "Virtool:Win32/Obfuscator.KI",
              "target": "/malware/Virtool:Win32/Obfuscator.KI"
            },
            {
              "id": "Toga!rfn",
              "display_name": "Toga!rfn",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "Win.Malware.Remoteadmin-7056666-0",
              "display_name": "Win.Malware.Remoteadmin-7056666-0",
              "target": null
            },
            {
              "id": "Floxif",
              "display_name": "Floxif",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Win.Dropper.Unruy-9994363-0",
              "display_name": "Win.Dropper.Unruy-9994363-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Cycler-47",
              "display_name": "Win.Trojan.Cycler-47",
              "target": null
            },
            {
              "id": "Win.Trojan.Clicker-3506",
              "display_name": "Win.Trojan.Clicker-3506",
              "target": null
            },
            {
              "id": "Win.Downloader.Unruy-10026469-0",
              "display_name": "Win.Downloader.Unruy-10026469-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "Win.Malware.Urelas",
              "display_name": "Win.Malware.Urelas",
              "target": null
            },
            {
              "id": "Win.Malware.Zusy",
              "display_name": "Win.Malware.Zusy",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
              "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
              "target": null
            },
            {
              "id": "Win.Malware.Eclz-9953021-0",
              "display_name": "Win.Malware.Eclz-9953021-0",
              "target": null
            },
            {
              "id": "#Lowfi:SuspiciousSectionName",
              "display_name": "#Lowfi:SuspiciousSectionName",
              "target": null
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
              "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
              "target": null
            },
            {
              "id": "Win.Dropper.Tiggre-9845940-0",
              "display_name": "Win.Dropper.Tiggre-9845940-0",
              "target": null
            },
            {
              "id": "PWS:Win32/QQpass.B!MTB",
              "display_name": "PWS:Win32/QQpass.B!MTB",
              "target": "/malware/PWS:Win32/QQpass.B!MTB"
            },
            {
              "id": "Win.Malware.Sfwx-9853337-0",
              "display_name": "Win.Malware.Sfwx-9853337-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Trojan:Win32/Kaicorn!rf",
              "display_name": "Trojan:Win32/Kaicorn!rf",
              "target": "/malware/Trojan:Win32/Kaicorn!rf"
            },
            {
              "id": "Win32:Banker",
              "display_name": "Win32:Banker",
              "target": null
            },
            {
              "id": "Worm:Win32/Cambot!rfn",
              "display_name": "Worm:Win32/Cambot!rfn",
              "target": "/malware/Worm:Win32/Cambot!rfn"
            },
            {
              "id": "Win32:Malware",
              "display_name": "Win32:Malware",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1401",
              "name": "Device Administrator Permissions",
              "display_name": "T1401 - Device Administrator Permissions"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1595.002",
              "name": "Vulnerability Scanning",
              "display_name": "T1595.002 - Vulnerability Scanning"
            },
            {
              "id": "T1464",
              "name": "Jamming or Denial of Service",
              "display_name": "T1464 - Jamming or Denial of Service"
            },
            {
              "id": "T1588.001",
              "name": "Malware",
              "display_name": "T1588.001 - Malware"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "68c5743593a4bcc81dd94b0b",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1323,
            "URL": 4360,
            "FileHash-MD5": 759,
            "FileHash-SHA1": 748,
            "FileHash-SHA256": 5148,
            "domain": 1076,
            "email": 7
          },
          "indicator_count": 13421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "86 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c5743593a4bcc81dd94b0b",
          "name": "Fed.PayPal.com - Ransom | Attacks via redirect",
          "description": "A monitored target, active on various payment platforms for business documented a malicious redirect event 1st seen in 2020. Follows pattern of multiple, critical and ongoing attacks beginning in 2013. In this instance target lost access to PayPal payments. If this is legal, it\u2019s been a grotesque grift. Target was financially and otherwise robbed.\n\n\n#trulymissed #paypal #advesaries #apple #twitter #backdoor #ransom #botnet #reptutationattack",
          "modified": "2025-10-13T13:27:11.277000",
          "created": "2025-09-13T13:40:05.671000",
          "tags": [
            "present sep",
            "virtool",
            "cryp",
            "win32",
            "ip address",
            "trojan",
            "ransom",
            "asn as54113",
            "passive dns",
            "msil",
            "united states",
            "dynamicloader",
            "qaeaav12",
            "high",
            "qbeipbdii",
            "write",
            "paypal",
            "medium",
            "search",
            "vmware",
            "floodfix",
            "malware",
            "united",
            "mtb apr",
            "hostname add",
            "write c",
            "read c",
            "yara detections",
            "upxoepplace",
            "next",
            "markus",
            "april",
            "ping",
            "meta http",
            "content",
            "gmt server",
            "th th",
            "443 ma2592000",
            "ipv4 add",
            "url analysis",
            "urls",
            "body",
            "title",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "t1590 gather",
            "victim network",
            "status",
            "name servers",
            "set cookie",
            "script urls",
            "present feb",
            "cookie",
            "template",
            "present oct",
            "present jul",
            "present dec",
            "present jun",
            "next associated",
            "urls show",
            "date checked",
            "present apr",
            "url hostname",
            "united kingdom",
            "unknown ns",
            "servers",
            "great britain",
            "msr aug",
            "msr apr",
            "msr nov",
            "ite o",
            "server response",
            "script script",
            "files show",
            "date hash",
            "avast avg",
            "creation date",
            "lcid1033",
            "sminnotek",
            "spnvirtualbox",
            "bvvirtualbox",
            "present mar",
            "present nov",
            "exploit",
            "error",
            "server response",
            "google safe",
            "results sep",
            "backdoor",
            "certificate",
            "mtb sep",
            "next http",
            "scans show",
            "present may",
            "results jun",
            "results jan",
            "worm",
            "echo request",
            "sweep",
            "payload hello",
            "world",
            "ids detections",
            "cape",
            "viking",
            "philis",
            "et",
            "torop",
            "des moines",
            "contacted hosts",
            "content reputation",
            "sabey type",
            "tulach type",
            "rexx type",
            "foundry type",
            "fred scherr",
            "twitter",
            "apple",
            "monitored target",
            "financial theft",
            "psalms 27: 1 - 14"
          ],
          "references": [
            "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]",
            "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com",
            "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368",
            "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com",
            "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/",
            "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/",
            "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/",
            "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1",
            "https://twitter.com/PORNO_SEXYBABES \u2022  https://megapornfreehd.com/2025/04/360",
            "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32:MalOb-BX\\ [Cryp]",
              "display_name": "Win32:MalOb-BX\\ [Cryp]",
              "target": null
            },
            {
              "id": "Win.Trojan.Fraudpack",
              "display_name": "Win.Trojan.Fraudpack",
              "target": null
            },
            {
              "id": "Fakeav",
              "display_name": "Fakeav",
              "target": null
            },
            {
              "id": "Ransom:MSIL/Genasom.I",
              "display_name": "Ransom:MSIL/Genasom.I",
              "target": "/malware/Ransom:MSIL/Genasom.I"
            },
            {
              "id": "Virtool:Win32/Obfuscator.KI",
              "display_name": "Virtool:Win32/Obfuscator.KI",
              "target": "/malware/Virtool:Win32/Obfuscator.KI"
            },
            {
              "id": "Toga!rfn",
              "display_name": "Toga!rfn",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "Win.Malware.Remoteadmin-7056666-0",
              "display_name": "Win.Malware.Remoteadmin-7056666-0",
              "target": null
            },
            {
              "id": "Floxif",
              "display_name": "Floxif",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Win.Dropper.Unruy-9994363-0",
              "display_name": "Win.Dropper.Unruy-9994363-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Cycler-47",
              "display_name": "Win.Trojan.Cycler-47",
              "target": null
            },
            {
              "id": "Win.Trojan.Clicker-3506",
              "display_name": "Win.Trojan.Clicker-3506",
              "target": null
            },
            {
              "id": "Win.Downloader.Unruy-10026469-0",
              "display_name": "Win.Downloader.Unruy-10026469-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "Win.Malware.Urelas",
              "display_name": "Win.Malware.Urelas",
              "target": null
            },
            {
              "id": "Win.Malware.Zusy",
              "display_name": "Win.Malware.Zusy",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
              "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
              "target": null
            },
            {
              "id": "Win.Malware.Eclz-9953021-0",
              "display_name": "Win.Malware.Eclz-9953021-0",
              "target": null
            },
            {
              "id": "#Lowfi:SuspiciousSectionName",
              "display_name": "#Lowfi:SuspiciousSectionName",
              "target": null
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
              "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
              "target": null
            },
            {
              "id": "Win.Dropper.Tiggre-9845940-0",
              "display_name": "Win.Dropper.Tiggre-9845940-0",
              "target": null
            },
            {
              "id": "PWS:Win32/QQpass.B!MTB",
              "display_name": "PWS:Win32/QQpass.B!MTB",
              "target": "/malware/PWS:Win32/QQpass.B!MTB"
            },
            {
              "id": "Win.Malware.Sfwx-9853337-0",
              "display_name": "Win.Malware.Sfwx-9853337-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Trojan:Win32/Kaicorn!rf",
              "display_name": "Trojan:Win32/Kaicorn!rf",
              "target": "/malware/Trojan:Win32/Kaicorn!rf"
            },
            {
              "id": "Win32:Banker",
              "display_name": "Win32:Banker",
              "target": null
            },
            {
              "id": "Worm:Win32/Cambot!rfn",
              "display_name": "Worm:Win32/Cambot!rfn",
              "target": "/malware/Worm:Win32/Cambot!rfn"
            },
            {
              "id": "Win32:Malware",
              "display_name": "Win32:Malware",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1401",
              "name": "Device Administrator Permissions",
              "display_name": "T1401 - Device Administrator Permissions"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1595.002",
              "name": "Vulnerability Scanning",
              "display_name": "T1595.002 - Vulnerability Scanning"
            },
            {
              "id": "T1464",
              "name": "Jamming or Denial of Service",
              "display_name": "T1464 - Jamming or Denial of Service"
            },
            {
              "id": "T1588.001",
              "name": "Malware",
              "display_name": "T1588.001 - Malware"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1321,
            "URL": 4356,
            "FileHash-MD5": 759,
            "FileHash-SHA1": 748,
            "FileHash-SHA256": 5148,
            "domain": 1076,
            "email": 7
          },
          "indicator_count": 13415,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "659d687f92ebb4f3d613ae0c",
          "name": "Mimikatz | www.ssc.spaceforce.mil ",
          "description": "",
          "modified": "2024-01-09T15:38:39.547000",
          "created": "2024-01-09T15:38:39.547000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655cd0f065d2e5a6c92369e5",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "873 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655cd0f065d2e5a6c92369e5",
          "name": "www.ssc.spaceforce.mil",
          "description": "",
          "modified": "2023-12-21T15:00:07.190000",
          "created": "2023-11-21T15:46:56.740000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ce5116519bd86d1f1bdee",
          "name": "FormBook | www.ssc.spaceforce.mil 'Hoax' | Spyware | Fraud Services",
          "description": "",
          "modified": "2023-12-21T15:00:07.190000",
          "created": "2023-11-21T17:12:49.783000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "656aa27f81a9096f5889a9d0",
          "name": "WebToolbar | www.ssc.spaceforce.mil ",
          "description": "",
          "modified": "2023-12-21T15:00:07.190000",
          "created": "2023-12-02T03:20:31.494000",
          "tags": [
            "a domains",
            "united",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "link",
            "passive dns",
            "space systems",
            "urls",
            "search",
            "encrypt",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "referrer",
            "resolutions",
            "communicating",
            "collections",
            "contacted",
            "sneaky server",
            "team",
            "metro",
            "hacktool",
            "tsara brashears",
            "apple ios",
            "highly targeted",
            "core",
            "android",
            "formbook",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "copy",
            "relic",
            "monitoring",
            "installer",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "csc corporate",
            "domains",
            "cloudflare",
            "cloudflarenet",
            "akamaias",
            "summary iocs",
            "b item",
            "cisco umbrella",
            "site",
            "maltiverse",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "tsgeneric",
            "riskware",
            "unsafe",
            "phishing",
            "union",
            "bank",
            "opencandy",
            "exploit",
            "agent",
            "mimikatz",
            "webtoolbar",
            "no expiration",
            "expiration",
            "indicator role",
            "pulses url",
            "url https",
            "domain",
            "url http",
            "brashears type",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655cd0f065d2e5a6c92369e5",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 101,
            "FileHash-SHA1": 81,
            "hostname": 1376,
            "URL": 3305,
            "domain": 572,
            "FileHash-SHA256": 3300,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655950034e6ae4650a6b02ce",
          "name": "Python Initiated Connection | Spyware |  Remote Attacks  |  | Part 4",
          "description": "Apple, Mac, iOS, phishing, frauds services, malware, trojan.allesgreh/trojan.allesgreh/respat, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and possibly others. Python Initiated Connection, WScriptShell_Case_Anomaly.\nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
          "modified": "2023-12-18T23:03:18.732000",
          "created": "2023-11-19T00:00:03.258000",
          "tags": [
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "contenttype",
            "phpsessid",
            "cisco umbrella",
            "alexa top",
            "million",
            "safe site",
            "site",
            "whois record",
            "ssl certificate",
            "execution",
            "dropped",
            "whois whois",
            "historical ssl",
            "copy",
            "tsara brashears",
            "communicating",
            "referrer",
            "cobalt strike",
            "hacktool",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "relic",
            "monitoring",
            "installer",
            "android",
            "agent tesla",
            "et",
            "october",
            "contacted",
            "threat roundup",
            "january",
            "cyberstalking",
            "attack",
            "icmp",
            "banker",
            "keylogger",
            "google llc",
            "gc abuse",
            "orgid",
            "direct",
            "whois lookup",
            "netrange",
            "nethandle",
            "net34",
            "net340000",
            "googl2",
            "comment",
            "gc",
            "dns replication",
            "date",
            "domain",
            "win32 exe",
            "driver pro",
            "files",
            "detections type",
            "name",
            "optimizer pro",
            "javascript",
            "text",
            "text ip",
            "aacr",
            "type name",
            "email",
            "email delivery",
            "email fwd",
            "delivery status",
            "notification",
            "name verdict",
            "runtime process",
            "sha1",
            "size",
            "localappdata",
            "temp",
            "prefetch8",
            "unicode text",
            "type data",
            "programfiles",
            "win64",
            "hybrid",
            "click",
            "strings",
            "youth",
            "pe resource",
            "apple private",
            "data collection",
            "hidden privacy",
            "threats https",
            "legal",
            "amazon aws",
            "wife happy",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "magic pe32",
            "intel",
            "ms windows",
            "trid windows",
            "os2 executable",
            "compiler",
            "delphi",
            "sections",
            "md5 code",
            "data",
            "children",
            "file size",
            "dropped files",
            "google update",
            "setup sha256",
            "kb file"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "GC",
              "display_name": "GC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12901,
            "hostname": 4445,
            "domain": 3685,
            "FileHash-MD5": 197,
            "FileHash-SHA256": 5136,
            "FileHash-SHA1": 170,
            "CIDR": 1,
            "email": 2,
            "CVE": 4
          },
          "indicator_count": 26541,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "895 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655aef8a8cc2e0929f2aa5ea",
          "name": "Python Initiated Connection | Spyware | Remote Attacks |",
          "description": "",
          "modified": "2023-12-18T23:03:18.732000",
          "created": "2023-11-20T05:32:58.400000",
          "tags": [
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "contenttype",
            "phpsessid",
            "cisco umbrella",
            "alexa top",
            "million",
            "safe site",
            "site",
            "whois record",
            "ssl certificate",
            "execution",
            "dropped",
            "whois whois",
            "historical ssl",
            "copy",
            "tsara brashears",
            "communicating",
            "referrer",
            "cobalt strike",
            "hacktool",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "relic",
            "monitoring",
            "installer",
            "android",
            "agent tesla",
            "et",
            "october",
            "contacted",
            "threat roundup",
            "january",
            "cyberstalking",
            "attack",
            "icmp",
            "banker",
            "keylogger",
            "google llc",
            "gc abuse",
            "orgid",
            "direct",
            "whois lookup",
            "netrange",
            "nethandle",
            "net34",
            "net340000",
            "googl2",
            "comment",
            "gc",
            "dns replication",
            "date",
            "domain",
            "win32 exe",
            "driver pro",
            "files",
            "detections type",
            "name",
            "optimizer pro",
            "javascript",
            "text",
            "text ip",
            "aacr",
            "type name",
            "email",
            "email delivery",
            "email fwd",
            "delivery status",
            "notification",
            "name verdict",
            "runtime process",
            "sha1",
            "size",
            "localappdata",
            "temp",
            "prefetch8",
            "unicode text",
            "type data",
            "programfiles",
            "win64",
            "hybrid",
            "click",
            "strings",
            "youth",
            "pe resource",
            "apple private",
            "data collection",
            "hidden privacy",
            "threats https",
            "legal",
            "amazon aws",
            "wife happy",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "magic pe32",
            "intel",
            "ms windows",
            "trid windows",
            "os2 executable",
            "compiler",
            "delphi",
            "sections",
            "md5 code",
            "data",
            "children",
            "file size",
            "dropped files",
            "google update",
            "setup sha256",
            "kb file"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "GC",
              "display_name": "GC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655950034e6ae4650a6b02ce",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12901,
            "hostname": 4445,
            "domain": 3685,
            "FileHash-MD5": 197,
            "FileHash-SHA256": 5136,
            "FileHash-SHA1": 170,
            "CIDR": 1,
            "email": 2,
            "CVE": 4
          },
          "indicator_count": 26541,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "895 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655907b4d8c905f4475d8bcc",
          "name": "Apple iOS Spyware |  Remote Attacks  | Fraud Services | Part 3",
          "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
          "modified": "2023-12-18T16:03:26.037000",
          "created": "2023-11-18T18:51:32.856000",
          "tags": [
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "contenttype",
            "phpsessid",
            "cisco umbrella",
            "alexa top",
            "million",
            "safe site",
            "site",
            "whois record",
            "ssl certificate",
            "execution",
            "dropped",
            "whois whois",
            "historical ssl",
            "copy",
            "tsara brashears",
            "communicating",
            "referrer",
            "cobalt strike",
            "hacktool",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "relic",
            "monitoring",
            "installer",
            "android",
            "agent tesla",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8650,
            "hostname": 3073,
            "domain": 2708,
            "FileHash-MD5": 118,
            "FileHash-SHA256": 3552,
            "FileHash-SHA1": 104
          },
          "indicator_count": 18205,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "895 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655907b9da2479892590b77a",
          "name": "Apple iOS Spyware |  Remote Attacks  | Fraud Services | Part 3",
          "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
          "modified": "2023-12-18T16:03:26.037000",
          "created": "2023-11-18T18:51:37.411000",
          "tags": [
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "contenttype",
            "phpsessid",
            "cisco umbrella",
            "alexa top",
            "million",
            "safe site",
            "site",
            "whois record",
            "ssl certificate",
            "execution",
            "dropped",
            "whois whois",
            "historical ssl",
            "copy",
            "tsara brashears",
            "communicating",
            "referrer",
            "cobalt strike",
            "hacktool",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "relic",
            "monitoring",
            "installer",
            "android",
            "agent tesla",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8650,
            "hostname": 3073,
            "domain": 2708,
            "FileHash-MD5": 118,
            "FileHash-SHA256": 3552,
            "FileHash-SHA1": 104
          },
          "indicator_count": 18205,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "895 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708cbaff7263ec6e06baa7",
          "name": "http://www.ftpftpftp.com/yk.exe",
          "description": "",
          "modified": "2023-12-06T15:01:14.367000",
          "created": "2023-12-06T15:01:14.367000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 177,
            "FileHash-MD5": 62,
            "FileHash-SHA1": 47,
            "URL": 439,
            "domain": 111,
            "hostname": 112,
            "CVE": 1
          },
          "indicator_count": 949,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708cb730ef54f76f707779",
          "name": "http://www.ftpftpftp.com/yk.exe",
          "description": "",
          "modified": "2023-12-06T15:01:11.538000",
          "created": "2023-12-06T15:01:11.538000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 168,
            "FileHash-MD5": 62,
            "FileHash-SHA1": 47,
            "URL": 371,
            "domain": 95,
            "hostname": 89,
            "CVE": 1
          },
          "indicator_count": 833,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62688d358d6c324c85aa0842",
          "name": "http://www.ftpftpftp.com/yk.exe",
          "description": "",
          "modified": "2022-05-27T00:00:15.468000",
          "created": "2022-04-27T00:24:21.317000",
          "tags": [],
          "references": [
            "https://hybrid-analysis.com/sample/e970d327564392cac3cedaa816dfd4a0906405b653394de9894bf65590c3e944/626706d6f95729098b37ac9d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 371,
            "hostname": 89,
            "domain": 95,
            "FileHash-SHA256": 168,
            "CVE": 1,
            "FileHash-MD5": 62,
            "FileHash-SHA1": 47
          },
          "indicator_count": 833,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1465 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62688d3680f604c08644d1f5",
          "name": "http://www.ftpftpftp.com/yk.exe",
          "description": "",
          "modified": "2022-05-27T00:00:15.468000",
          "created": "2022-04-27T00:24:22.553000",
          "tags": [],
          "references": [
            "https://hybrid-analysis.com/sample/e970d327564392cac3cedaa816dfd4a0906405b653394de9894bf65590c3e944/626706d6f95729098b37ac9d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 439,
            "hostname": 112,
            "domain": 111,
            "FileHash-SHA256": 177,
            "CVE": 1,
            "FileHash-MD5": 62,
            "FileHash-SHA1": 47
          },
          "indicator_count": 949,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 396,
          "modified_text": "1465 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/",
        "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368",
        "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/",
        "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://twitter.com/PORNO_SEXYBABES \u2022  https://megapornfreehd.com/2025/04/360",
        "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com",
        "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com",
        "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/",
        "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/",
        "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]",
        "https://hybrid-analysis.com/sample/e970d327564392cac3cedaa816dfd4a0906405b653394de9894bf65590c3e944/626706d6f95729098b37ac9d"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.dropper.tiggre-9845940-0",
            "Worm:win32/cambot!rfn",
            "Win32:malob-bx\\ [cryp]",
            "#lowfi:suspicioussectionname",
            "Win32:banker",
            "Webtoolbar",
            "Fakeav",
            "Win.malware.remoteadmin-7056666-0",
            "Alf:hstr:trojandownloader:win32/purityscan.a!bit",
            "Trojan:win32/kaicorn!rf",
            "Ransom:msil/genasom.i",
            "Win32:malware",
            "Floxif",
            "Toga!rfn",
            "Win.trojan.clicker-3506",
            "Malware",
            "Pws:win32/qqpass.b!mtb",
            "Win.malware.eclz-9953021-0",
            "Worm:win32/autorun",
            "Win.malware.midie-6847892-0",
            "Win.trojan.fraudpack",
            "Trojan:win32/floxif.e",
            "Virtool:win32/obfuscator.ki",
            "Win.malware.sfwx-9853337-0",
            "Et",
            "Win.trojan.cycler-47",
            "Gc",
            "Win.dropper.unruy-9994363-0",
            "Backdoor:win32/tofsee.t",
            "Win.malware.urelas",
            "Win.downloader.unruy-10026469-0",
            "Tofsee",
            "Alf:heraklezeval:pws:win32/qqpass!rfn",
            "Win.malware.zusy"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 14,
  "pulses": [
    {
      "id": "69aa0a62f94a92b5168405c2",
      "name": "fedpaypal clone Q vashti",
      "description": "",
      "modified": "2026-03-06T06:39:27.872000",
      "created": "2026-03-05T22:57:38.559000",
      "tags": [
        "present sep",
        "virtool",
        "cryp",
        "win32",
        "ip address",
        "trojan",
        "ransom",
        "asn as54113",
        "passive dns",
        "msil",
        "united states",
        "dynamicloader",
        "qaeaav12",
        "high",
        "qbeipbdii",
        "write",
        "paypal",
        "medium",
        "search",
        "vmware",
        "floodfix",
        "malware",
        "united",
        "mtb apr",
        "hostname add",
        "write c",
        "read c",
        "yara detections",
        "upxoepplace",
        "next",
        "markus",
        "april",
        "ping",
        "meta http",
        "content",
        "gmt server",
        "th th",
        "443 ma2592000",
        "ipv4 add",
        "url analysis",
        "urls",
        "body",
        "title",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "t1590 gather",
        "victim network",
        "status",
        "name servers",
        "set cookie",
        "script urls",
        "present feb",
        "cookie",
        "template",
        "present oct",
        "present jul",
        "present dec",
        "present jun",
        "next associated",
        "urls show",
        "date checked",
        "present apr",
        "url hostname",
        "united kingdom",
        "unknown ns",
        "servers",
        "great britain",
        "msr aug",
        "msr apr",
        "msr nov",
        "ite o",
        "server response",
        "script script",
        "files show",
        "date hash",
        "avast avg",
        "creation date",
        "lcid1033",
        "sminnotek",
        "spnvirtualbox",
        "bvvirtualbox",
        "present mar",
        "present nov",
        "exploit",
        "error",
        "server response",
        "google safe",
        "results sep",
        "backdoor",
        "certificate",
        "mtb sep",
        "next http",
        "scans show",
        "present may",
        "results jun",
        "results jan",
        "worm",
        "echo request",
        "sweep",
        "payload hello",
        "world",
        "ids detections",
        "cape",
        "viking",
        "philis",
        "et",
        "torop",
        "des moines",
        "contacted hosts",
        "content reputation",
        "sabey type",
        "tulach type",
        "rexx type",
        "foundry type",
        "fred scherr",
        "twitter",
        "apple",
        "monitored target",
        "financial theft",
        "psalms 27: 1 - 14"
      ],
      "references": [
        "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]",
        "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com",
        "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368",
        "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com",
        "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/",
        "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/",
        "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/",
        "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1",
        "https://twitter.com/PORNO_SEXYBABES \u2022  https://megapornfreehd.com/2025/04/360",
        "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win32:MalOb-BX\\ [Cryp]",
          "display_name": "Win32:MalOb-BX\\ [Cryp]",
          "target": null
        },
        {
          "id": "Win.Trojan.Fraudpack",
          "display_name": "Win.Trojan.Fraudpack",
          "target": null
        },
        {
          "id": "Fakeav",
          "display_name": "Fakeav",
          "target": null
        },
        {
          "id": "Ransom:MSIL/Genasom.I",
          "display_name": "Ransom:MSIL/Genasom.I",
          "target": "/malware/Ransom:MSIL/Genasom.I"
        },
        {
          "id": "Virtool:Win32/Obfuscator.KI",
          "display_name": "Virtool:Win32/Obfuscator.KI",
          "target": "/malware/Virtool:Win32/Obfuscator.KI"
        },
        {
          "id": "Toga!rfn",
          "display_name": "Toga!rfn",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "Win.Malware.Remoteadmin-7056666-0",
          "display_name": "Win.Malware.Remoteadmin-7056666-0",
          "target": null
        },
        {
          "id": "Floxif",
          "display_name": "Floxif",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Win.Dropper.Unruy-9994363-0",
          "display_name": "Win.Dropper.Unruy-9994363-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Cycler-47",
          "display_name": "Win.Trojan.Cycler-47",
          "target": null
        },
        {
          "id": "Win.Trojan.Clicker-3506",
          "display_name": "Win.Trojan.Clicker-3506",
          "target": null
        },
        {
          "id": "Win.Downloader.Unruy-10026469-0",
          "display_name": "Win.Downloader.Unruy-10026469-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "Win.Malware.Urelas",
          "display_name": "Win.Malware.Urelas",
          "target": null
        },
        {
          "id": "Win.Malware.Zusy",
          "display_name": "Win.Malware.Zusy",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
          "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
          "target": null
        },
        {
          "id": "Win.Malware.Eclz-9953021-0",
          "display_name": "Win.Malware.Eclz-9953021-0",
          "target": null
        },
        {
          "id": "#Lowfi:SuspiciousSectionName",
          "display_name": "#Lowfi:SuspiciousSectionName",
          "target": null
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
          "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
          "target": null
        },
        {
          "id": "Win.Dropper.Tiggre-9845940-0",
          "display_name": "Win.Dropper.Tiggre-9845940-0",
          "target": null
        },
        {
          "id": "PWS:Win32/QQpass.B!MTB",
          "display_name": "PWS:Win32/QQpass.B!MTB",
          "target": "/malware/PWS:Win32/QQpass.B!MTB"
        },
        {
          "id": "Win.Malware.Sfwx-9853337-0",
          "display_name": "Win.Malware.Sfwx-9853337-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Trojan:Win32/Kaicorn!rf",
          "display_name": "Trojan:Win32/Kaicorn!rf",
          "target": "/malware/Trojan:Win32/Kaicorn!rf"
        },
        {
          "id": "Win32:Banker",
          "display_name": "Win32:Banker",
          "target": null
        },
        {
          "id": "Worm:Win32/Cambot!rfn",
          "display_name": "Worm:Win32/Cambot!rfn",
          "target": "/malware/Worm:Win32/Cambot!rfn"
        },
        {
          "id": "Win32:Malware",
          "display_name": "Win32:Malware",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1450",
          "name": "Exploit SS7 to Track Device Location",
          "display_name": "T1450 - Exploit SS7 to Track Device Location"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1401",
          "name": "Device Administrator Permissions",
          "display_name": "T1401 - Device Administrator Permissions"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1595.002",
          "name": "Vulnerability Scanning",
          "display_name": "T1595.002 - Vulnerability Scanning"
        },
        {
          "id": "T1464",
          "name": "Jamming or Denial of Service",
          "display_name": "T1464 - Jamming or Denial of Service"
        },
        {
          "id": "T1588.001",
          "name": "Malware",
          "display_name": "T1588.001 - Malware"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "68c5743593a4bcc81dd94b0b",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1323,
        "URL": 4360,
        "FileHash-MD5": 759,
        "FileHash-SHA1": 748,
        "FileHash-SHA256": 5148,
        "domain": 1076,
        "email": 7
      },
      "indicator_count": 13421,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "86 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c5743593a4bcc81dd94b0b",
      "name": "Fed.PayPal.com - Ransom | Attacks via redirect",
      "description": "A monitored target, active on various payment platforms for business documented a malicious redirect event 1st seen in 2020. Follows pattern of multiple, critical and ongoing attacks beginning in 2013. In this instance target lost access to PayPal payments. If this is legal, it\u2019s been a grotesque grift. Target was financially and otherwise robbed.\n\n\n#trulymissed #paypal #advesaries #apple #twitter #backdoor #ransom #botnet #reptutationattack",
      "modified": "2025-10-13T13:27:11.277000",
      "created": "2025-09-13T13:40:05.671000",
      "tags": [
        "present sep",
        "virtool",
        "cryp",
        "win32",
        "ip address",
        "trojan",
        "ransom",
        "asn as54113",
        "passive dns",
        "msil",
        "united states",
        "dynamicloader",
        "qaeaav12",
        "high",
        "qbeipbdii",
        "write",
        "paypal",
        "medium",
        "search",
        "vmware",
        "floodfix",
        "malware",
        "united",
        "mtb apr",
        "hostname add",
        "write c",
        "read c",
        "yara detections",
        "upxoepplace",
        "next",
        "markus",
        "april",
        "ping",
        "meta http",
        "content",
        "gmt server",
        "th th",
        "443 ma2592000",
        "ipv4 add",
        "url analysis",
        "urls",
        "body",
        "title",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "t1590 gather",
        "victim network",
        "status",
        "name servers",
        "set cookie",
        "script urls",
        "present feb",
        "cookie",
        "template",
        "present oct",
        "present jul",
        "present dec",
        "present jun",
        "next associated",
        "urls show",
        "date checked",
        "present apr",
        "url hostname",
        "united kingdom",
        "unknown ns",
        "servers",
        "great britain",
        "msr aug",
        "msr apr",
        "msr nov",
        "ite o",
        "server response",
        "script script",
        "files show",
        "date hash",
        "avast avg",
        "creation date",
        "lcid1033",
        "sminnotek",
        "spnvirtualbox",
        "bvvirtualbox",
        "present mar",
        "present nov",
        "exploit",
        "error",
        "server response",
        "google safe",
        "results sep",
        "backdoor",
        "certificate",
        "mtb sep",
        "next http",
        "scans show",
        "present may",
        "results jun",
        "results jan",
        "worm",
        "echo request",
        "sweep",
        "payload hello",
        "world",
        "ids detections",
        "cape",
        "viking",
        "philis",
        "et",
        "torop",
        "des moines",
        "contacted hosts",
        "content reputation",
        "sabey type",
        "tulach type",
        "rexx type",
        "foundry type",
        "fred scherr",
        "twitter",
        "apple",
        "monitored target",
        "financial theft",
        "psalms 27: 1 - 14"
      ],
      "references": [
        "fed.paypal.com [redirect for monitored target \u2022 1st documented 2020- still active]",
        "nr-data.net \u2022 init.ess.apple.com\t\u2022 apple-id-ifind.com \u2022 https://apple-id-ifind.com/\t\u2022 apple-lostandfound.com",
        "https://www.speakup.it/magazines/places/new-york-city-on-a-budget-big-apple-little-money_2368",
        "https://login.apple-mac.banugoker.com/cgi-sys/defaultwebpage.cgi \u2022 lsupport-apple.com",
        "login.apple-mac.banugoker.com \u2022 www.apple-mac.banugoker.com \u2022 http://apple-mac.banugoker.com/",
        "https://apple-mac.banugoker.com/ \u2022 https://login.apple-mac.banugoker.com/",
        "http://45.159.189.105/bot/regex \u2022 https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com \u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/ tsara-brashears/urlscan-io\t \u2022 https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022 http://www.mohurd.gov.cn.lxcvc.\u2022 com/ \u2022 https://www.csrc.gov.cn.lxcvc.com/",
        "https://lk-prod-webcol.laika.com.co/category/bog/cat/farmacia/collares-isabelinos/todos/todo-para-mascota/1",
        "https://twitter.com/PORNO_SEXYBABES \u2022  https://megapornfreehd.com/2025/04/360",
        "https://57d5.zhanyu66.com/com.slamyugllp.strangerrun.xc.apk/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win32:MalOb-BX\\ [Cryp]",
          "display_name": "Win32:MalOb-BX\\ [Cryp]",
          "target": null
        },
        {
          "id": "Win.Trojan.Fraudpack",
          "display_name": "Win.Trojan.Fraudpack",
          "target": null
        },
        {
          "id": "Fakeav",
          "display_name": "Fakeav",
          "target": null
        },
        {
          "id": "Ransom:MSIL/Genasom.I",
          "display_name": "Ransom:MSIL/Genasom.I",
          "target": "/malware/Ransom:MSIL/Genasom.I"
        },
        {
          "id": "Virtool:Win32/Obfuscator.KI",
          "display_name": "Virtool:Win32/Obfuscator.KI",
          "target": "/malware/Virtool:Win32/Obfuscator.KI"
        },
        {
          "id": "Toga!rfn",
          "display_name": "Toga!rfn",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "Win.Malware.Remoteadmin-7056666-0",
          "display_name": "Win.Malware.Remoteadmin-7056666-0",
          "target": null
        },
        {
          "id": "Floxif",
          "display_name": "Floxif",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Win.Dropper.Unruy-9994363-0",
          "display_name": "Win.Dropper.Unruy-9994363-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Cycler-47",
          "display_name": "Win.Trojan.Cycler-47",
          "target": null
        },
        {
          "id": "Win.Trojan.Clicker-3506",
          "display_name": "Win.Trojan.Clicker-3506",
          "target": null
        },
        {
          "id": "Win.Downloader.Unruy-10026469-0",
          "display_name": "Win.Downloader.Unruy-10026469-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "Win.Malware.Urelas",
          "display_name": "Win.Malware.Urelas",
          "target": null
        },
        {
          "id": "Win.Malware.Zusy",
          "display_name": "Win.Malware.Zusy",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
          "display_name": "ALF:HeraklezEval:PWS:Win32/QQPass!rfn",
          "target": null
        },
        {
          "id": "Win.Malware.Eclz-9953021-0",
          "display_name": "Win.Malware.Eclz-9953021-0",
          "target": null
        },
        {
          "id": "#Lowfi:SuspiciousSectionName",
          "display_name": "#Lowfi:SuspiciousSectionName",
          "target": null
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
          "display_name": "ALF:HSTR:TrojanDownloader:Win32/PurityScan.A!bit",
          "target": null
        },
        {
          "id": "Win.Dropper.Tiggre-9845940-0",
          "display_name": "Win.Dropper.Tiggre-9845940-0",
          "target": null
        },
        {
          "id": "PWS:Win32/QQpass.B!MTB",
          "display_name": "PWS:Win32/QQpass.B!MTB",
          "target": "/malware/PWS:Win32/QQpass.B!MTB"
        },
        {
          "id": "Win.Malware.Sfwx-9853337-0",
          "display_name": "Win.Malware.Sfwx-9853337-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Trojan:Win32/Kaicorn!rf",
          "display_name": "Trojan:Win32/Kaicorn!rf",
          "target": "/malware/Trojan:Win32/Kaicorn!rf"
        },
        {
          "id": "Win32:Banker",
          "display_name": "Win32:Banker",
          "target": null
        },
        {
          "id": "Worm:Win32/Cambot!rfn",
          "display_name": "Worm:Win32/Cambot!rfn",
          "target": "/malware/Worm:Win32/Cambot!rfn"
        },
        {
          "id": "Win32:Malware",
          "display_name": "Win32:Malware",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1450",
          "name": "Exploit SS7 to Track Device Location",
          "display_name": "T1450 - Exploit SS7 to Track Device Location"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1401",
          "name": "Device Administrator Permissions",
          "display_name": "T1401 - Device Administrator Permissions"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1595.002",
          "name": "Vulnerability Scanning",
          "display_name": "T1595.002 - Vulnerability Scanning"
        },
        {
          "id": "T1464",
          "name": "Jamming or Denial of Service",
          "display_name": "T1464 - Jamming or Denial of Service"
        },
        {
          "id": "T1588.001",
          "name": "Malware",
          "display_name": "T1588.001 - Malware"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1321,
        "URL": 4356,
        "FileHash-MD5": 759,
        "FileHash-SHA1": 748,
        "FileHash-SHA256": 5148,
        "domain": 1076,
        "email": 7
      },
      "indicator_count": 13415,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "659d687f92ebb4f3d613ae0c",
      "name": "Mimikatz | www.ssc.spaceforce.mil ",
      "description": "",
      "modified": "2024-01-09T15:38:39.547000",
      "created": "2024-01-09T15:38:39.547000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655cd0f065d2e5a6c92369e5",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "873 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655cd0f065d2e5a6c92369e5",
      "name": "www.ssc.spaceforce.mil",
      "description": "",
      "modified": "2023-12-21T15:00:07.190000",
      "created": "2023-11-21T15:46:56.740000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "892 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ce5116519bd86d1f1bdee",
      "name": "FormBook | www.ssc.spaceforce.mil 'Hoax' | Spyware | Fraud Services",
      "description": "",
      "modified": "2023-12-21T15:00:07.190000",
      "created": "2023-11-21T17:12:49.783000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "892 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "656aa27f81a9096f5889a9d0",
      "name": "WebToolbar | www.ssc.spaceforce.mil ",
      "description": "",
      "modified": "2023-12-21T15:00:07.190000",
      "created": "2023-12-02T03:20:31.494000",
      "tags": [
        "a domains",
        "united",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "link",
        "passive dns",
        "space systems",
        "urls",
        "search",
        "encrypt",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "referrer",
        "resolutions",
        "communicating",
        "collections",
        "contacted",
        "sneaky server",
        "team",
        "metro",
        "hacktool",
        "tsara brashears",
        "apple ios",
        "highly targeted",
        "core",
        "android",
        "formbook",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "copy",
        "relic",
        "monitoring",
        "installer",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "csc corporate",
        "domains",
        "cloudflare",
        "cloudflarenet",
        "akamaias",
        "summary iocs",
        "b item",
        "cisco umbrella",
        "site",
        "maltiverse",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "tsgeneric",
        "riskware",
        "unsafe",
        "phishing",
        "union",
        "bank",
        "opencandy",
        "exploit",
        "agent",
        "mimikatz",
        "webtoolbar",
        "no expiration",
        "expiration",
        "indicator role",
        "pulses url",
        "url https",
        "domain",
        "url http",
        "brashears type",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655cd0f065d2e5a6c92369e5",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 101,
        "FileHash-SHA1": 81,
        "hostname": 1376,
        "URL": 3305,
        "domain": 572,
        "FileHash-SHA256": 3300,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "892 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655950034e6ae4650a6b02ce",
      "name": "Python Initiated Connection | Spyware |  Remote Attacks  |  | Part 4",
      "description": "Apple, Mac, iOS, phishing, frauds services, malware, trojan.allesgreh/trojan.allesgreh/respat, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and possibly others. Python Initiated Connection, WScriptShell_Case_Anomaly.\nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
      "modified": "2023-12-18T23:03:18.732000",
      "created": "2023-11-19T00:00:03.258000",
      "tags": [
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "contenttype",
        "phpsessid",
        "cisco umbrella",
        "alexa top",
        "million",
        "safe site",
        "site",
        "whois record",
        "ssl certificate",
        "execution",
        "dropped",
        "whois whois",
        "historical ssl",
        "copy",
        "tsara brashears",
        "communicating",
        "referrer",
        "cobalt strike",
        "hacktool",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "relic",
        "monitoring",
        "installer",
        "android",
        "agent tesla",
        "et",
        "october",
        "contacted",
        "threat roundup",
        "january",
        "cyberstalking",
        "attack",
        "icmp",
        "banker",
        "keylogger",
        "google llc",
        "gc abuse",
        "orgid",
        "direct",
        "whois lookup",
        "netrange",
        "nethandle",
        "net34",
        "net340000",
        "googl2",
        "comment",
        "gc",
        "dns replication",
        "date",
        "domain",
        "win32 exe",
        "driver pro",
        "files",
        "detections type",
        "name",
        "optimizer pro",
        "javascript",
        "text",
        "text ip",
        "aacr",
        "type name",
        "email",
        "email delivery",
        "email fwd",
        "delivery status",
        "notification",
        "name verdict",
        "runtime process",
        "sha1",
        "size",
        "localappdata",
        "temp",
        "prefetch8",
        "unicode text",
        "type data",
        "programfiles",
        "win64",
        "hybrid",
        "click",
        "strings",
        "youth",
        "pe resource",
        "apple private",
        "data collection",
        "hidden privacy",
        "threats https",
        "legal",
        "amazon aws",
        "wife happy",
        "vhash",
        "authentihash",
        "ssdeep",
        "file type",
        "magic pe32",
        "intel",
        "ms windows",
        "trid windows",
        "os2 executable",
        "compiler",
        "delphi",
        "sections",
        "md5 code",
        "data",
        "children",
        "file size",
        "dropped files",
        "google update",
        "setup sha256",
        "kb file"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "GC",
          "display_name": "GC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12901,
        "hostname": 4445,
        "domain": 3685,
        "FileHash-MD5": 197,
        "FileHash-SHA256": 5136,
        "FileHash-SHA1": 170,
        "CIDR": 1,
        "email": 2,
        "CVE": 4
      },
      "indicator_count": 26541,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "895 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655aef8a8cc2e0929f2aa5ea",
      "name": "Python Initiated Connection | Spyware | Remote Attacks |",
      "description": "",
      "modified": "2023-12-18T23:03:18.732000",
      "created": "2023-11-20T05:32:58.400000",
      "tags": [
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "contenttype",
        "phpsessid",
        "cisco umbrella",
        "alexa top",
        "million",
        "safe site",
        "site",
        "whois record",
        "ssl certificate",
        "execution",
        "dropped",
        "whois whois",
        "historical ssl",
        "copy",
        "tsara brashears",
        "communicating",
        "referrer",
        "cobalt strike",
        "hacktool",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "relic",
        "monitoring",
        "installer",
        "android",
        "agent tesla",
        "et",
        "october",
        "contacted",
        "threat roundup",
        "january",
        "cyberstalking",
        "attack",
        "icmp",
        "banker",
        "keylogger",
        "google llc",
        "gc abuse",
        "orgid",
        "direct",
        "whois lookup",
        "netrange",
        "nethandle",
        "net34",
        "net340000",
        "googl2",
        "comment",
        "gc",
        "dns replication",
        "date",
        "domain",
        "win32 exe",
        "driver pro",
        "files",
        "detections type",
        "name",
        "optimizer pro",
        "javascript",
        "text",
        "text ip",
        "aacr",
        "type name",
        "email",
        "email delivery",
        "email fwd",
        "delivery status",
        "notification",
        "name verdict",
        "runtime process",
        "sha1",
        "size",
        "localappdata",
        "temp",
        "prefetch8",
        "unicode text",
        "type data",
        "programfiles",
        "win64",
        "hybrid",
        "click",
        "strings",
        "youth",
        "pe resource",
        "apple private",
        "data collection",
        "hidden privacy",
        "threats https",
        "legal",
        "amazon aws",
        "wife happy",
        "vhash",
        "authentihash",
        "ssdeep",
        "file type",
        "magic pe32",
        "intel",
        "ms windows",
        "trid windows",
        "os2 executable",
        "compiler",
        "delphi",
        "sections",
        "md5 code",
        "data",
        "children",
        "file size",
        "dropped files",
        "google update",
        "setup sha256",
        "kb file"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "GC",
          "display_name": "GC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655950034e6ae4650a6b02ce",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12901,
        "hostname": 4445,
        "domain": 3685,
        "FileHash-MD5": 197,
        "FileHash-SHA256": 5136,
        "FileHash-SHA1": 170,
        "CIDR": 1,
        "email": 2,
        "CVE": 4
      },
      "indicator_count": 26541,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "895 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655907b4d8c905f4475d8bcc",
      "name": "Apple iOS Spyware |  Remote Attacks  | Fraud Services | Part 3",
      "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
      "modified": "2023-12-18T16:03:26.037000",
      "created": "2023-11-18T18:51:32.856000",
      "tags": [
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "contenttype",
        "phpsessid",
        "cisco umbrella",
        "alexa top",
        "million",
        "safe site",
        "site",
        "whois record",
        "ssl certificate",
        "execution",
        "dropped",
        "whois whois",
        "historical ssl",
        "copy",
        "tsara brashears",
        "communicating",
        "referrer",
        "cobalt strike",
        "hacktool",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "relic",
        "monitoring",
        "installer",
        "android",
        "agent tesla",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8650,
        "hostname": 3073,
        "domain": 2708,
        "FileHash-MD5": 118,
        "FileHash-SHA256": 3552,
        "FileHash-SHA1": 104
      },
      "indicator_count": 18205,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "895 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655907b9da2479892590b77a",
      "name": "Apple iOS Spyware |  Remote Attacks  | Fraud Services | Part 3",
      "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
      "modified": "2023-12-18T16:03:26.037000",
      "created": "2023-11-18T18:51:37.411000",
      "tags": [
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "contenttype",
        "phpsessid",
        "cisco umbrella",
        "alexa top",
        "million",
        "safe site",
        "site",
        "whois record",
        "ssl certificate",
        "execution",
        "dropped",
        "whois whois",
        "historical ssl",
        "copy",
        "tsara brashears",
        "communicating",
        "referrer",
        "cobalt strike",
        "hacktool",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "relic",
        "monitoring",
        "installer",
        "android",
        "agent tesla",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8650,
        "hostname": 3073,
        "domain": 2708,
        "FileHash-MD5": 118,
        "FileHash-SHA256": 3552,
        "FileHash-SHA1": 104
      },
      "indicator_count": 18205,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "895 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "zigqnx.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "zigqnx.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780269458.758737
}