10032 lines
405 KiB
JSON
10032 lines
405 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5b115d30-5fe8-4016-a4d5-5fb80acd0835",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2021-05-24T09:49:21.000Z",
|
||
|
|
"modified": "2021-05-24T09:49:21.000Z",
|
||
|
|
"name": "Synovus Financial",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5b115d30-5fe8-4016-a4d5-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2021-05-24T09:49:21.000Z",
|
||
|
|
"modified": "2021-05-24T09:49:21.000Z",
|
||
|
|
"name": "One IP hosting multiple phishing domains",
|
||
|
|
"published": "2020-05-11T07:59:05Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5b115dcc-5ff4-4e5c-814f-60570acd0835",
|
||
|
|
"indicator--5b115dcc-67dc-4347-b9b5-60570acd0835",
|
||
|
|
"indicator--5b115dcc-4038-4150-80a1-60570acd0835",
|
||
|
|
"indicator--5b115dcc-7b28-4a6d-8365-60570acd0835",
|
||
|
|
"indicator--5b115dcc-c61c-490a-9e67-60570acd0835",
|
||
|
|
"indicator--5b115dcc-7b10-4ffe-b6cc-60570acd0835",
|
||
|
|
"indicator--5b115dcc-d1e0-4f0d-8482-60570acd0835",
|
||
|
|
"indicator--5b115dcc-e430-4c1b-9934-60570acd0835",
|
||
|
|
"indicator--5b115dcc-3ee8-48e4-9b37-60570acd0835",
|
||
|
|
"indicator--5b115dcc-8de8-4039-b0d6-60570acd0835",
|
||
|
|
"indicator--5b115dcc-6f40-4dc2-ad03-60570acd0835",
|
||
|
|
"indicator--5b115dcd-9f00-41d9-8d3f-60570acd0835",
|
||
|
|
"indicator--5b115dcd-bc40-4f9f-9eae-60570acd0835",
|
||
|
|
"indicator--5b115dcd-418c-4426-9981-60570acd0835",
|
||
|
|
"indicator--5b115dcd-85dc-40dc-82ef-60570acd0835",
|
||
|
|
"indicator--5b115dcd-7138-40b5-aee0-60570acd0835",
|
||
|
|
"indicator--5b115dcd-f8d4-42c8-877e-60570acd0835",
|
||
|
|
"indicator--5b115dcd-871c-4caa-9107-60570acd0835",
|
||
|
|
"indicator--5b115dcd-16f4-46d3-aa97-60570acd0835",
|
||
|
|
"indicator--5b115dcd-2750-43c5-abd5-60570acd0835",
|
||
|
|
"indicator--5b115dcd-9978-4d83-a7c0-60570acd0835",
|
||
|
|
"indicator--5b115dcd-b4a0-45a6-8095-60570acd0835",
|
||
|
|
"indicator--5b115dcd-ae54-44f6-8686-60570acd0835",
|
||
|
|
"indicator--5b115dcd-3200-4da2-a9c0-60570acd0835",
|
||
|
|
"indicator--5b115dcd-645c-4b1c-a145-60570acd0835",
|
||
|
|
"indicator--5b115dcd-241c-4daa-b2da-60570acd0835",
|
||
|
|
"indicator--5b115dcd-2b7c-4581-a96c-60570acd0835",
|
||
|
|
"indicator--5b115dcd-d454-4b48-be97-60570acd0835",
|
||
|
|
"indicator--5b115dcd-d18c-4cb8-b84c-60570acd0835",
|
||
|
|
"indicator--5b115dcd-6ff4-4cde-987d-60570acd0835",
|
||
|
|
"indicator--5b115dcd-b808-4aee-b419-60570acd0835",
|
||
|
|
"indicator--5b115dcd-16a8-4762-a623-60570acd0835",
|
||
|
|
"indicator--5b115dcd-fbe8-4ab7-858c-60570acd0835",
|
||
|
|
"indicator--5b115dcd-a9f0-4d25-89b4-60570acd0835",
|
||
|
|
"indicator--5b115dcd-3620-4772-8da6-60570acd0835",
|
||
|
|
"indicator--5b115dcd-e8fc-4607-a2f1-60570acd0835",
|
||
|
|
"indicator--5b115dcd-38e0-4906-a206-60570acd0835",
|
||
|
|
"indicator--5b115dcd-8608-40a3-a194-60570acd0835",
|
||
|
|
"indicator--5b115dcd-170c-411e-a19a-60570acd0835",
|
||
|
|
"indicator--5b115dcd-664c-4a9a-98fd-60570acd0835",
|
||
|
|
"indicator--5b115dcd-05d0-4f4d-af98-60570acd0835",
|
||
|
|
"indicator--5b115dcd-3a84-4473-b80b-60570acd0835",
|
||
|
|
"indicator--5b115dcd-7954-4c85-8ecf-60570acd0835",
|
||
|
|
"indicator--5b115dcd-9cd4-40bf-85c9-60570acd0835",
|
||
|
|
"indicator--5b115dcd-1e78-45d2-a577-60570acd0835",
|
||
|
|
"indicator--5b115dcd-8678-4031-aac8-60570acd0835",
|
||
|
|
"indicator--5b115dcd-c4ec-4629-a8cb-60570acd0835",
|
||
|
|
"indicator--5b115dcd-f20c-4c21-914d-60570acd0835",
|
||
|
|
"indicator--5b115dcd-f908-4a6e-8e3f-60570acd0835",
|
||
|
|
"indicator--5b115dcd-a94c-468d-b159-60570acd0835",
|
||
|
|
"indicator--5b115dcd-96e0-4da8-bd0b-60570acd0835",
|
||
|
|
"indicator--5b115dcd-77f8-4986-af5c-60570acd0835",
|
||
|
|
"indicator--5b115dcd-e5d4-49d4-9df4-60570acd0835",
|
||
|
|
"indicator--5b115dcd-a888-4a5e-9643-60570acd0835",
|
||
|
|
"indicator--5b115dcd-d208-41be-be2e-60570acd0835",
|
||
|
|
"indicator--5b115dcd-9690-4c38-af4b-60570acd0835",
|
||
|
|
"indicator--5b115dcd-cdfc-47f1-bdc5-60570acd0835",
|
||
|
|
"indicator--5b115dcd-3f9c-4406-9059-60570acd0835",
|
||
|
|
"indicator--5b115dcd-6060-4a53-b782-60570acd0835",
|
||
|
|
"indicator--5b115dcd-cb80-4f12-b276-60570acd0835",
|
||
|
|
"indicator--5b115dcd-90dc-411e-b75e-60570acd0835",
|
||
|
|
"indicator--5b115dcd-7d4c-41d1-9f16-60570acd0835",
|
||
|
|
"indicator--5b115dcd-fac4-4bf7-955c-60570acd0835",
|
||
|
|
"indicator--5b115dcd-cca0-4186-bb82-60570acd0835",
|
||
|
|
"indicator--5b115dcd-5b28-4af1-bac2-60570acd0835",
|
||
|
|
"indicator--5b115dcd-af08-419b-9c12-60570acd0835",
|
||
|
|
"indicator--5b115dcd-08d4-4ebb-b330-60570acd0835",
|
||
|
|
"indicator--5b115dcd-5d68-4dfd-8a0f-60570acd0835",
|
||
|
|
"indicator--5b115dcd-0c80-492c-8ea1-60570acd0835",
|
||
|
|
"indicator--5b115dcd-36c0-49b5-a4df-60570acd0835",
|
||
|
|
"indicator--5b115dcd-76c4-41ad-8b95-60570acd0835",
|
||
|
|
"indicator--5b115dcd-b1b4-4e80-ad07-60570acd0835",
|
||
|
|
"indicator--5b115dcd-e740-41a4-8c9b-60570acd0835",
|
||
|
|
"indicator--5b115dcd-ed74-43ea-a94b-60570acd0835",
|
||
|
|
"indicator--5b115dcd-f024-44c7-a198-60570acd0835",
|
||
|
|
"indicator--5b115dcd-8a24-4cd0-bddc-60570acd0835",
|
||
|
|
"indicator--5b115dcd-6a74-42b8-8300-60570acd0835",
|
||
|
|
"indicator--5b115dcd-507c-4088-b8c9-60570acd0835",
|
||
|
|
"indicator--5b115dcd-dcd0-45b9-b34f-60570acd0835",
|
||
|
|
"indicator--5b115dcd-9f70-4c59-abfc-60570acd0835",
|
||
|
|
"indicator--5b115dcd-ec34-46f1-8cf7-60570acd0835",
|
||
|
|
"indicator--5b115dcd-ec58-41bf-ab5e-60570acd0835",
|
||
|
|
"indicator--5b115dcd-5f1c-485c-ab29-60570acd0835",
|
||
|
|
"indicator--5b115dcd-d144-47de-bbc6-60570acd0835",
|
||
|
|
"indicator--5b115dcd-30ac-4c9c-974f-60570acd0835",
|
||
|
|
"indicator--5b115dcd-68e0-47a0-9f69-60570acd0835",
|
||
|
|
"indicator--5b115dcd-4524-4d03-892f-60570acd0835",
|
||
|
|
"indicator--5b115dce-3024-4153-b72d-60570acd0835",
|
||
|
|
"indicator--5b115dce-5cfc-4e73-bbbc-60570acd0835",
|
||
|
|
"indicator--5b115dce-3c20-4345-97f6-60570acd0835",
|
||
|
|
"indicator--5b115dce-7d74-46a2-be94-60570acd0835",
|
||
|
|
"indicator--5b115dce-0b58-4693-9c87-60570acd0835",
|
||
|
|
"indicator--5b115dce-7bf0-4dcc-b4ce-60570acd0835",
|
||
|
|
"indicator--5b115dce-0ea0-4047-a23c-60570acd0835",
|
||
|
|
"indicator--5b115dce-32e8-4fbe-a9c2-60570acd0835",
|
||
|
|
"indicator--5b115dce-70b8-4005-b76b-60570acd0835",
|
||
|
|
"indicator--5b115dce-6a08-4e8b-8e6c-60570acd0835",
|
||
|
|
"indicator--5b115dce-abd4-43ec-b326-60570acd0835",
|
||
|
|
"indicator--5b115dce-ce4c-4e29-85bf-60570acd0835",
|
||
|
|
"indicator--5b115dce-cd3c-4bc6-aa4b-60570acd0835",
|
||
|
|
"indicator--5b115dce-394c-41c4-8a6d-60570acd0835",
|
||
|
|
"indicator--5b115dce-e030-4cab-9670-60570acd0835",
|
||
|
|
"indicator--5b115dce-bf94-4238-b515-60570acd0835",
|
||
|
|
"indicator--5b115dce-17d0-406b-a6de-60570acd0835",
|
||
|
|
"indicator--5b115dce-9a18-4633-9070-60570acd0835",
|
||
|
|
"indicator--5b115dce-51c8-4485-9c27-60570acd0835",
|
||
|
|
"indicator--5b115dce-2a48-49d9-bac5-60570acd0835",
|
||
|
|
"indicator--5b115dce-5ed4-454b-80ff-60570acd0835",
|
||
|
|
"indicator--5b115dce-a6cc-446c-9385-60570acd0835",
|
||
|
|
"indicator--5b115dce-89f4-4a7f-bdb7-60570acd0835",
|
||
|
|
"indicator--5b115dce-2498-48fb-8766-60570acd0835",
|
||
|
|
"indicator--5b115dce-d478-4ac6-969b-60570acd0835",
|
||
|
|
"indicator--5b115dce-3a60-4586-9c9e-60570acd0835",
|
||
|
|
"indicator--5b115dce-8898-4822-9204-60570acd0835",
|
||
|
|
"indicator--5b115dce-ed14-4de6-ab9f-60570acd0835",
|
||
|
|
"indicator--5b115dce-4a88-44c0-9816-60570acd0835",
|
||
|
|
"indicator--5b115dce-a158-41b5-96ea-60570acd0835",
|
||
|
|
"indicator--5b115dce-0638-498e-9c31-60570acd0835",
|
||
|
|
"indicator--5b115dce-0d34-4840-b151-60570acd0835",
|
||
|
|
"indicator--5b115dce-143c-4b08-a3d8-60570acd0835",
|
||
|
|
"indicator--5b115dce-2db8-41c2-b77b-60570acd0835",
|
||
|
|
"indicator--5b115dce-9334-4179-97d9-60570acd0835",
|
||
|
|
"indicator--5b115dce-efd8-4ffa-904b-60570acd0835",
|
||
|
|
"indicator--5b115dce-59e8-4c71-8f27-60570acd0835",
|
||
|
|
"indicator--5b115dce-5e4c-441b-821d-60570acd0835",
|
||
|
|
"indicator--5b115dce-9360-4966-bddc-60570acd0835",
|
||
|
|
"indicator--5b115dce-05ec-4a2b-bfbe-60570acd0835",
|
||
|
|
"indicator--5b115dce-106c-45b1-86ec-60570acd0835",
|
||
|
|
"indicator--5b115dce-41bc-4e2d-8a18-60570acd0835",
|
||
|
|
"indicator--5b115dce-cd48-435d-b5e5-60570acd0835",
|
||
|
|
"indicator--5b115dce-742c-493f-b215-60570acd0835",
|
||
|
|
"indicator--5b115dce-9234-445b-a9ab-60570acd0835",
|
||
|
|
"indicator--5b115dce-73b0-4455-88d0-60570acd0835",
|
||
|
|
"indicator--5b115dce-2f88-4522-8901-60570acd0835",
|
||
|
|
"indicator--5b115dce-e350-4336-ac4d-60570acd0835",
|
||
|
|
"indicator--5b115dce-e470-4450-94b5-60570acd0835",
|
||
|
|
"indicator--5b115dce-0fdc-4f21-9310-60570acd0835",
|
||
|
|
"indicator--5b115dce-3144-4aa0-8989-60570acd0835",
|
||
|
|
"indicator--5b115dce-ec78-4482-a94b-60570acd0835",
|
||
|
|
"indicator--5b115dce-7b88-4d60-b652-60570acd0835",
|
||
|
|
"indicator--5b115dce-5d6c-481c-b554-60570acd0835",
|
||
|
|
"indicator--5b115dce-40dc-4b03-bb76-60570acd0835",
|
||
|
|
"indicator--5b115dce-3b5c-4546-96c2-60570acd0835",
|
||
|
|
"indicator--5b115dce-e9cc-4452-9467-60570acd0835",
|
||
|
|
"indicator--5b115dce-6bf8-4d65-a8f7-60570acd0835",
|
||
|
|
"indicator--5b115dce-1fdc-4fbe-9759-60570acd0835",
|
||
|
|
"indicator--5b115dce-d3c0-455d-b9f9-60570acd0835",
|
||
|
|
"indicator--5b115dce-e9f8-4ba5-8f4a-60570acd0835",
|
||
|
|
"indicator--5b115dce-e794-4e9b-a137-60570acd0835",
|
||
|
|
"indicator--5b115dce-0750-41f9-8c8d-60570acd0835",
|
||
|
|
"indicator--5b115dce-28dc-4c41-9758-60570acd0835",
|
||
|
|
"indicator--5b115dce-7df8-45d7-929f-60570acd0835",
|
||
|
|
"indicator--5b115dce-a450-445a-9164-60570acd0835",
|
||
|
|
"indicator--5b115dce-604c-42ba-ad83-60570acd0835",
|
||
|
|
"indicator--5b115dce-8304-46b0-b72b-60570acd0835",
|
||
|
|
"indicator--5b115dce-944c-4cd9-9dd2-60570acd0835",
|
||
|
|
"indicator--5b115dce-2b90-49d8-8c91-60570acd0835",
|
||
|
|
"indicator--5b115dce-1708-4327-b9ec-60570acd0835",
|
||
|
|
"indicator--5b115dce-8160-442c-90b8-60570acd0835",
|
||
|
|
"indicator--5b115dce-c358-4710-877e-60570acd0835",
|
||
|
|
"indicator--5b115dce-7cfc-429f-9318-60570acd0835",
|
||
|
|
"indicator--5b115dce-83f8-42b4-a2c9-60570acd0835",
|
||
|
|
"indicator--5b115dce-5678-4c66-9fbb-60570acd0835",
|
||
|
|
"indicator--5b115dce-d2c8-4c59-8c2f-60570acd0835",
|
||
|
|
"indicator--5b115dce-d48c-4047-964f-60570acd0835",
|
||
|
|
"indicator--5b115dce-71ac-474d-98f5-60570acd0835",
|
||
|
|
"indicator--5b115dce-ec08-4fca-910b-60570acd0835",
|
||
|
|
"indicator--5b115dce-c80c-4496-8baf-60570acd0835",
|
||
|
|
"indicator--5b115dcf-0a28-4374-add4-60570acd0835",
|
||
|
|
"indicator--5b115dcf-e608-4e2b-a73c-60570acd0835",
|
||
|
|
"indicator--5b115dcf-0e9c-4fff-a995-60570acd0835",
|
||
|
|
"indicator--5b115dcf-195c-4781-b021-60570acd0835",
|
||
|
|
"indicator--5b115dcf-5748-471a-add7-60570acd0835",
|
||
|
|
"indicator--5b115dcf-b08c-495d-9726-60570acd0835",
|
||
|
|
"indicator--5b115dcf-5b98-454a-9ad6-60570acd0835",
|
||
|
|
"indicator--5b115dcf-8878-49a3-a6b7-60570acd0835",
|
||
|
|
"indicator--5b115dcf-2f78-4477-942a-60570acd0835",
|
||
|
|
"indicator--5b115dcf-d97c-4588-bbff-60570acd0835",
|
||
|
|
"indicator--5b115dcf-f6fc-4f8f-9e52-60570acd0835",
|
||
|
|
"indicator--5b115dcf-25ac-4321-9bc1-60570acd0835",
|
||
|
|
"indicator--5b115dcf-f9bc-4aeb-adab-60570acd0835",
|
||
|
|
"indicator--5b115dcf-9358-4b00-a7ce-60570acd0835",
|
||
|
|
"indicator--5b115dcf-ac8c-40d1-9589-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1fe0-41ae-94d4-60570acd0835",
|
||
|
|
"indicator--5b115dcf-3340-4845-bca6-60570acd0835",
|
||
|
|
"indicator--5b115dcf-a15c-44d5-8ffe-60570acd0835",
|
||
|
|
"indicator--5b115dcf-c8c0-47c5-badb-60570acd0835",
|
||
|
|
"indicator--5b115dcf-6000-4cb0-b5fb-60570acd0835",
|
||
|
|
"indicator--5b115dcf-4c24-4176-a471-60570acd0835",
|
||
|
|
"indicator--5b115dcf-91a0-4f6b-bce4-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1984-40c3-8192-60570acd0835",
|
||
|
|
"indicator--5b115dcf-17c4-4e10-bdb6-60570acd0835",
|
||
|
|
"indicator--5b115dcf-fbfc-4bcb-9ec2-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1b0c-4cc6-89e2-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1a70-4fad-936c-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1994-46b8-8d24-60570acd0835",
|
||
|
|
"indicator--5b115dcf-3180-40eb-9c1e-60570acd0835",
|
||
|
|
"indicator--5b115dcf-31d8-4c6f-97b8-60570acd0835",
|
||
|
|
"indicator--5b115dcf-5c3c-42b8-9d92-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1edc-49fd-ba21-60570acd0835",
|
||
|
|
"indicator--5b115dcf-453c-4cb0-8d94-60570acd0835",
|
||
|
|
"indicator--5b115dcf-db30-4387-8820-60570acd0835",
|
||
|
|
"indicator--5b115dcf-3e1c-436f-bedb-60570acd0835",
|
||
|
|
"indicator--5b115dcf-9230-40b2-8d8f-60570acd0835",
|
||
|
|
"indicator--5b115dcf-1c2c-4337-ace9-60570acd0835",
|
||
|
|
"indicator--5b115dcf-ed5c-45bb-ba61-60570acd0835",
|
||
|
|
"indicator--5b115dcf-681c-417a-a337-60570acd0835",
|
||
|
|
"indicator--5b115dcf-9fac-401b-9401-60570acd0835",
|
||
|
|
"indicator--5b115dcf-a78c-4477-8435-60570acd0835",
|
||
|
|
"indicator--5b115dcf-4d18-44fb-b36c-60570acd0835",
|
||
|
|
"indicator--5b115dcf-fcb0-4e87-a4b7-60570acd0835",
|
||
|
|
"indicator--5b115dcf-f5b8-4a4d-ba7f-60570acd0835",
|
||
|
|
"indicator--5b115dcf-5840-4a6f-9465-60570acd0835",
|
||
|
|
"indicator--5b115dcf-78e0-4d53-9c70-60570acd0835",
|
||
|
|
"indicator--5b115dcf-cdbc-481e-961d-60570acd0835",
|
||
|
|
"indicator--5b115dcf-41d8-41d5-ba9d-60570acd0835",
|
||
|
|
"indicator--5b115dcf-a568-4f4a-8ef1-60570acd0835",
|
||
|
|
"indicator--5b115dcf-9448-47b9-853a-60570acd0835",
|
||
|
|
"indicator--5b115dcf-dbdc-4574-aa68-60570acd0835",
|
||
|
|
"indicator--5b115dcf-11d4-452f-8490-60570acd0835",
|
||
|
|
"indicator--5b115dcf-2bb4-45f6-a74b-60570acd0835",
|
||
|
|
"indicator--5b115dcf-bd1c-49c4-a13f-60570acd0835",
|
||
|
|
"indicator--5b115dcf-0e10-4a24-9034-60570acd0835",
|
||
|
|
"indicator--5b115dcf-5220-4fea-83f1-60570acd0835",
|
||
|
|
"indicator--5b115dcf-7238-4a07-9a3c-60570acd0835",
|
||
|
|
"indicator--5b115dcf-b110-4248-8b57-60570acd0835",
|
||
|
|
"indicator--5b115dcf-8864-43fc-8389-60570acd0835",
|
||
|
|
"indicator--5b115dcf-074c-4a56-a1fb-60570acd0835",
|
||
|
|
"indicator--5b115dcf-3128-4e21-9390-60570acd0835",
|
||
|
|
"indicator--5b115dcf-0048-4ad8-a84f-60570acd0835",
|
||
|
|
"indicator--5b115dcf-6fb4-4b2c-8dac-60570acd0835",
|
||
|
|
"indicator--5b115dcf-eb7c-4091-81c4-60570acd0835",
|
||
|
|
"indicator--5b115dcf-8068-4827-92e4-60570acd0835",
|
||
|
|
"indicator--5b115dcf-69b4-4857-aa11-60570acd0835",
|
||
|
|
"indicator--5b115dcf-b4cc-4df9-bcdf-60570acd0835",
|
||
|
|
"indicator--5b115dcf-8ad0-400e-a41a-60570acd0835",
|
||
|
|
"indicator--5b115dcf-74e4-430a-80f5-60570acd0835",
|
||
|
|
"indicator--5b115dd0-5144-4c5a-bd72-60570acd0835",
|
||
|
|
"indicator--5b115dd0-92b4-4abc-8904-60570acd0835",
|
||
|
|
"indicator--5b115dd0-4400-47fb-af71-60570acd0835",
|
||
|
|
"indicator--5b115dd0-5bc8-44cb-8e41-60570acd0835",
|
||
|
|
"indicator--5b115dd0-250c-48f8-a8e2-60570acd0835",
|
||
|
|
"indicator--5b115dd0-fd20-4ddc-a68c-60570acd0835",
|
||
|
|
"indicator--5b115dd0-9fb8-46d0-baca-60570acd0835",
|
||
|
|
"indicator--5b115dd0-2f90-4826-9668-60570acd0835",
|
||
|
|
"indicator--5b115dd0-8d68-4d59-b197-60570acd0835",
|
||
|
|
"indicator--5b115dd0-9144-4bcd-92c3-60570acd0835",
|
||
|
|
"indicator--5b115dd0-d630-447b-9482-60570acd0835",
|
||
|
|
"indicator--5b115dd0-0848-4df7-be49-60570acd0835",
|
||
|
|
"indicator--5b115dd0-a568-4d98-84d8-60570acd0835",
|
||
|
|
"indicator--5b115dd0-2f40-4add-b5c1-60570acd0835",
|
||
|
|
"indicator--5b115dd0-e9c0-4dad-b780-60570acd0835",
|
||
|
|
"indicator--5b115dd0-d7bc-4d90-b3f3-60570acd0835",
|
||
|
|
"indicator--5b115dd0-2fb8-4113-a6b0-60570acd0835",
|
||
|
|
"indicator--5b115dd0-0fe4-45ff-a4d2-60570acd0835",
|
||
|
|
"indicator--5b115dd0-9014-4312-a30a-60570acd0835",
|
||
|
|
"indicator--5b115dd0-cddc-4bd5-8c7f-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b5d8-4547-abac-60570acd0835",
|
||
|
|
"indicator--5b115dd0-795c-4960-8ef1-60570acd0835",
|
||
|
|
"indicator--5b115dd0-a618-41f4-869e-60570acd0835",
|
||
|
|
"indicator--5b115dd0-e428-464d-b7f8-60570acd0835",
|
||
|
|
"indicator--5b115dd0-30d0-4daf-be5d-60570acd0835",
|
||
|
|
"indicator--5b115dd0-e308-404b-8dd1-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b540-4d72-8ad9-60570acd0835",
|
||
|
|
"indicator--5b115dd0-16b8-4da3-8545-60570acd0835",
|
||
|
|
"indicator--5b115dd0-acd0-4f74-b43a-60570acd0835",
|
||
|
|
"indicator--5b115dd0-2b14-47bb-81fc-60570acd0835",
|
||
|
|
"indicator--5b115dd0-8668-42b9-ada8-60570acd0835",
|
||
|
|
"indicator--5b115dd0-f4a8-4e39-a724-60570acd0835",
|
||
|
|
"indicator--5b115dd0-c5fc-4297-a1ea-60570acd0835",
|
||
|
|
"indicator--5b115dd0-8518-42ce-9c53-60570acd0835",
|
||
|
|
"indicator--5b115dd0-f484-44ec-874f-60570acd0835",
|
||
|
|
"indicator--5b115dd0-3bf8-4a83-bb76-60570acd0835",
|
||
|
|
"indicator--5b115dd0-f7f4-4d47-b9a5-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b3a8-48e7-9764-60570acd0835",
|
||
|
|
"indicator--5b115dd0-06c0-4f20-9acb-60570acd0835",
|
||
|
|
"indicator--5b115dd0-d39c-4655-85d7-60570acd0835",
|
||
|
|
"indicator--5b115dd0-8200-4e15-8b0c-60570acd0835",
|
||
|
|
"indicator--5b115dd0-df9c-4e54-9fd7-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b4ec-46cc-b5b6-60570acd0835",
|
||
|
|
"indicator--5b115dd0-1c30-45f0-9703-60570acd0835",
|
||
|
|
"indicator--5b115dd0-6890-452a-be6e-60570acd0835",
|
||
|
|
"indicator--5b115dd0-92d0-420c-8393-60570acd0835",
|
||
|
|
"indicator--5b115dd0-7f98-4c24-9c47-60570acd0835",
|
||
|
|
"indicator--5b115dd0-c984-48e4-916e-60570acd0835",
|
||
|
|
"indicator--5b115dd0-6bb8-4364-9cec-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b3b0-4efc-85c6-60570acd0835",
|
||
|
|
"indicator--5b115dd0-0c74-4dd2-9937-60570acd0835",
|
||
|
|
"indicator--5b115dd0-1048-4313-86de-60570acd0835",
|
||
|
|
"indicator--5b115dd0-2ce4-47e9-af7b-60570acd0835",
|
||
|
|
"indicator--5b115dd0-eebc-42c9-8354-60570acd0835",
|
||
|
|
"indicator--5b115dd0-83a8-4f68-aad7-60570acd0835",
|
||
|
|
"indicator--5b115dd0-be58-482e-a3a3-60570acd0835",
|
||
|
|
"indicator--5b115dd0-fad8-4ac2-825f-60570acd0835",
|
||
|
|
"indicator--5b115dd0-65d8-4201-9e6e-60570acd0835",
|
||
|
|
"indicator--5b115dd0-197c-4bd3-b754-60570acd0835",
|
||
|
|
"indicator--5b115dd0-febc-4072-b52e-60570acd0835",
|
||
|
|
"indicator--5b115dd0-cb20-4866-b68f-60570acd0835",
|
||
|
|
"indicator--5b115dd0-f11c-471f-9ce8-60570acd0835",
|
||
|
|
"indicator--5b115dd0-7044-4691-9ad6-60570acd0835",
|
||
|
|
"indicator--5b115dd0-0f58-4c9c-a2db-60570acd0835",
|
||
|
|
"indicator--5b115dd0-8c0c-4fff-968d-60570acd0835",
|
||
|
|
"indicator--5b115dd0-84f8-4ca3-866c-60570acd0835",
|
||
|
|
"indicator--5b115dd0-3d70-44e7-a996-60570acd0835",
|
||
|
|
"indicator--5b115dd0-1460-4a8e-9511-60570acd0835",
|
||
|
|
"indicator--5b115dd0-6850-4b76-8177-60570acd0835",
|
||
|
|
"indicator--5b115dd0-596c-4f7c-ba4c-60570acd0835",
|
||
|
|
"indicator--5b115dd0-d5fc-4b3a-b536-60570acd0835",
|
||
|
|
"indicator--5b115dd0-3564-4dac-a206-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b5b8-4a72-9687-60570acd0835",
|
||
|
|
"indicator--5b115dd0-e640-480e-ab86-60570acd0835",
|
||
|
|
"indicator--5b115dd0-27f8-44d9-b53a-60570acd0835",
|
||
|
|
"indicator--5b115dd0-ce78-44f9-a8eb-60570acd0835",
|
||
|
|
"indicator--5b115dd0-309c-41f9-95a9-60570acd0835",
|
||
|
|
"indicator--5b115dd0-1b78-4ac2-a230-60570acd0835",
|
||
|
|
"indicator--5b115dd0-6cd0-4a7a-962d-60570acd0835",
|
||
|
|
"indicator--5b115dd0-b8b0-4ddd-a366-60570acd0835",
|
||
|
|
"indicator--5b115dd0-43d8-4bc9-8d2c-60570acd0835",
|
||
|
|
"indicator--5b115dd0-6650-4667-93d0-60570acd0835",
|
||
|
|
"indicator--5b115dd0-0454-4f80-b554-60570acd0835",
|
||
|
|
"indicator--5b115dd0-6740-4309-bc99-60570acd0835",
|
||
|
|
"indicator--5b115dd1-4b38-47f8-935b-60570acd0835",
|
||
|
|
"indicator--5b115dd1-5da4-4611-a1c6-60570acd0835",
|
||
|
|
"indicator--5b115dd1-1cc4-49f0-b401-60570acd0835",
|
||
|
|
"indicator--5b115dd1-2914-4a30-bcdf-60570acd0835",
|
||
|
|
"indicator--5b115dd1-3bc8-4b3a-be84-60570acd0835",
|
||
|
|
"indicator--5b115dd1-30cc-46b5-bb6a-60570acd0835",
|
||
|
|
"indicator--5b115dd1-c8b4-4f85-9405-60570acd0835",
|
||
|
|
"indicator--5b115dd1-9fa4-48bf-bf2f-60570acd0835",
|
||
|
|
"indicator--5b115dd1-e8c8-406c-ac1a-60570acd0835",
|
||
|
|
"indicator--5b115dd1-fd0c-4bdd-93cb-60570acd0835",
|
||
|
|
"indicator--5b115dd1-3734-4443-a1ac-60570acd0835",
|
||
|
|
"indicator--5b115dd1-969c-4957-9cd1-60570acd0835",
|
||
|
|
"indicator--5b115dd1-18a4-45ec-9245-60570acd0835",
|
||
|
|
"indicator--5b115dd1-3580-4826-8df7-60570acd0835",
|
||
|
|
"indicator--5b115dd1-2cdc-4673-84a1-60570acd0835",
|
||
|
|
"indicator--5b115dd1-aea4-48fc-bd5a-60570acd0835",
|
||
|
|
"indicator--5b115dd1-3fa8-45ab-a6b8-60570acd0835",
|
||
|
|
"indicator--5b115dd1-ad60-4ec3-b54d-60570acd0835",
|
||
|
|
"indicator--5b115dd1-7258-466c-91cd-60570acd0835",
|
||
|
|
"indicator--5b115dd1-0624-40e7-aaab-60570acd0835",
|
||
|
|
"indicator--5b115dd1-dcf0-4ef7-96c0-60570acd0835",
|
||
|
|
"indicator--5b115dd1-6858-4589-8ba4-60570acd0835",
|
||
|
|
"indicator--5b115dd1-aab4-4d41-afc6-60570acd0835",
|
||
|
|
"indicator--5b115dd1-0ecc-458f-be9e-60570acd0835",
|
||
|
|
"indicator--5b115dd1-c104-4bed-a2c3-60570acd0835",
|
||
|
|
"indicator--5b115dd1-da5c-4075-8fc6-60570acd0835",
|
||
|
|
"indicator--5b115dd1-2768-4a30-a8ad-60570acd0835",
|
||
|
|
"indicator--5b115dd1-1cd0-4698-a620-60570acd0835",
|
||
|
|
"indicator--5b115dd1-5e24-4f9d-b928-60570acd0835",
|
||
|
|
"indicator--5b115dd1-6114-4ea7-82ba-60570acd0835",
|
||
|
|
"indicator--5b115dd1-ee94-4963-8704-60570acd0835",
|
||
|
|
"indicator--5b115dd1-255c-439e-a294-60570acd0835",
|
||
|
|
"indicator--5b115dd1-eb1c-449c-97cb-60570acd0835",
|
||
|
|
"indicator--5b115dd1-6680-46df-8b68-60570acd0835",
|
||
|
|
"indicator--5b115dd1-88f8-45f4-9560-60570acd0835",
|
||
|
|
"indicator--5b115dd1-4d04-4459-84fa-60570acd0835",
|
||
|
|
"indicator--5b115dd1-ddf4-46ec-a05e-60570acd0835",
|
||
|
|
"indicator--5b115dd1-92b4-484b-bda6-60570acd0835",
|
||
|
|
"indicator--5b115dd1-d4d0-43a8-9233-60570acd0835",
|
||
|
|
"indicator--5b115dd1-9d8c-4b2f-ada2-60570acd0835",
|
||
|
|
"indicator--5b115dd1-eb74-432e-a1b7-60570acd0835",
|
||
|
|
"indicator--5b115dd1-001c-471c-a19f-60570acd0835",
|
||
|
|
"indicator--5b115dd1-99b8-4981-8689-60570acd0835",
|
||
|
|
"indicator--5b115dd1-c4c8-42a8-a469-60570acd0835",
|
||
|
|
"indicator--5b115dd1-7528-4a5e-b0af-60570acd0835",
|
||
|
|
"indicator--5b115dd1-09b0-4bc1-9482-60570acd0835",
|
||
|
|
"indicator--5b115dd1-39d4-413a-9770-60570acd0835",
|
||
|
|
"indicator--5b115dd1-5a74-425a-884e-60570acd0835",
|
||
|
|
"indicator--5b115dd1-e0ec-450e-a86a-60570acd0835",
|
||
|
|
"indicator--5b115dd1-9aec-49bb-9cae-60570acd0835",
|
||
|
|
"indicator--5b115dd1-ea90-454b-b3cf-60570acd0835",
|
||
|
|
"indicator--5b115dd1-a730-4263-b3b6-60570acd0835",
|
||
|
|
"indicator--5b115dd1-cb9c-4f94-8e9c-60570acd0835",
|
||
|
|
"indicator--5b115dd1-0778-416c-b622-60570acd0835",
|
||
|
|
"indicator--5b115dd1-8c60-454f-bce9-60570acd0835",
|
||
|
|
"indicator--5b115dd1-c33c-4c6d-bc0f-60570acd0835",
|
||
|
|
"indicator--5b115dd1-0c60-4434-ab69-60570acd0835",
|
||
|
|
"indicator--5b115dd1-8804-47a7-8aec-60570acd0835",
|
||
|
|
"indicator--5b115dd1-ece4-4230-ba87-60570acd0835",
|
||
|
|
"indicator--5b115dd1-a028-496e-bad8-60570acd0835",
|
||
|
|
"indicator--5b115dd1-fd58-490b-afab-60570acd0835",
|
||
|
|
"indicator--5b115e30-3fa4-4dbf-b99f-5fb80acd0835",
|
||
|
|
"x-misp-attribute--5b115f15-8ee8-4eb0-882f-5aef0acd0835",
|
||
|
|
"x-misp-attribute--5b115f15-4178-4b68-b2ac-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-b630-4c49-97e5-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-1000-49b8-8d4a-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-5474-4254-821b-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-9150-44f5-bb41-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-72f4-44df-b198-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-9500-48cf-ba1b-5aef0acd0835",
|
||
|
|
"indicator--5b115f15-ce24-4154-8ebf-5aef0acd0835",
|
||
|
|
"observed-data--5b115f3f-d450-4377-9e35-68fa0acd0835",
|
||
|
|
"autonomous-system--5b115f3f-d450-4377-9e35-68fa0acd0835",
|
||
|
|
"indicator--5b115fe1-936c-4956-bfdd-5fb80acd0835",
|
||
|
|
"indicator--5b115fe1-de50-4293-af4a-5fb80acd0835",
|
||
|
|
"indicator--5b115fe1-1b34-438e-a731-5fb80acd0835",
|
||
|
|
"indicator--5b115fe1-cb4c-4d6c-b83c-5fb80acd0835",
|
||
|
|
"indicator--5b115fe1-2450-4e66-879e-5fb80acd0835",
|
||
|
|
"observed-data--5b11675c-2fc0-4507-82e1-69b00acd0835",
|
||
|
|
"url--5b11675c-2fc0-4507-82e1-69b00acd0835",
|
||
|
|
"indicator--5b1160a0-3980-4132-8d2c-66c90acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"veris:action:social:variety=\"Phishing\"",
|
||
|
|
"misp-galaxy:tool=\"FormBook\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-5ff4-4e5c-814f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'sig-in.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-67dc-4347-b9b5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ac.pn']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-4038-4150-80a1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ourladyofassumptioncollege.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-7b28-4a6d-8365-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'talisaycitycollegecebu.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-c61c-490a-9e67-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'udelvalle.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-7b10-4ffe-b6cc-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'worldmedicineinstitute.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-d1e0-4f0d-8482-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'boholnorthernstar.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-e430-4c1b-9934-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fsicollege.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-3ee8-48e4-9b37-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'iplcollege.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-8de8-4039-b0d6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'mabinicollegesdaet.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcc-6f40-4dc2-ad03-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:00.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:00.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'chemiefanforum.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-9f00-41d9-8d3f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dhondt-insurance.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-bc40-4f9f-9eae-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'pampangacolleges.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-418c-4426-9981-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'universidad-empresarial.ac.cr']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-85dc-40dc-82ef-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'universidad-politecnica.ac.pa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-7138-40b5-aee0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'amabn.nl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-f8d4-42c8-877e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cdseesc.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-871c-4caa-9107-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'collegeofmaryimmaculate.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-16f4-46d3-aa97-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'edexcourier.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-2750-43c5-abd5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fmdservices.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-9978-4d83-a7c0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'instituto-zapopan.com.mx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-b4a0-45a6-8095-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'jutarnji.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-ae54-44f6-8686-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'olmc-hra.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-3200-4da2-a9c0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'stpaulcolleges.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-645c-4b1c-a145-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'suuink.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-241c-4daa-b2da-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unem.edu.uy']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-2b7c-4581-a96c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unem.international']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-d454-4b48-be97-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'canterbury-alumni.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-d18c-4cb8-b84c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'mthompson.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-6ff4-4cde-987d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'upanamericana.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-b808-4aee-b419-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '365-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-16a8-4762-a623-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'accountco.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-fbe8-4ab7-858c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bakoodak.bid']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-a9f0-4d25-89b4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bulletproofhosting.tk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-3620-4772-8da6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'csaw.ml']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-e8fc-4607-a2f1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'customers-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-38e0-4906-a206-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dr0pb0x.site']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-8608-40a3-a194-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'financial-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-170c-411e-a19a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'isupply-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-664c-4a9a-98fd-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'kmusicdl.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-05d0-4f4d-af98-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'liongatecourier.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-3a84-4473-b80b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'mobe-affiliate.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-7954-4c85-8ecf-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nevadabank.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-9cd4-40bf-85c9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nevadatrust.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-1e78-45d2-a577-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'qazk.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-8678-4031-aac8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'qtbcapital.ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-c4ec-4629-a8cb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'talismanas.ml']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-f20c-4c21-914d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'xx55xx.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-f908-4a6e-8e3f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '101courier.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-a94c-468d-b159-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '10happybirthdaywishes.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-96e0-4da8-bd0b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '126email.bid']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-77f8-4986-af5c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '24hdown.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-e5d4-49d4-9df4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '7263s87391h103736a72839193723jj132728491gg25171211111.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-a888-4a5e-9643-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '87as56t32qas6gdi.tk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-d208-41be-be2e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = '99hddown.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-9690-4c38-af4b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'a-ogeoservices.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-cdfc-47f1-bdc5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'aai-b.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-3f9c-4406-9059-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'abcdrama.se']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-6060-4a53-b782-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ac.vu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-cb80-4f12-b276-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'accountt.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-90dc-411e-b75e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'accountt.review']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-7d4c-41d1-9f16-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ad-optimizely.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-fac4-4bf7-955c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'afexfinancetrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-cca0-4186-bb82-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'africa-barclays.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-5b28-4af1-bac2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'akbanks.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-af08-419b-9c12-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'alastairmicallef.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-08d4-4ebb-b330-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'alliancesavingbank.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-5d68-4dfd-8a0f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'alpinelco.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-0c80-492c-8ea1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'alshahidwitness.bid']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-36c0-49b5-a4df-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'amazoncashbacks.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-76c4-41ad-8b95-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ameu.gdn']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-b1b4-4e80-ad07-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'andressorianocollege.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-e740-41a4-8c9b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'antonngo.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-ed74-43ea-a94b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'api-care.gq']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-f024-44c7-a198-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'appids.se']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-8a24-4cd0-bddc-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'apple-conec.men']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-6a74-42b8-8300-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'apple-login.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-507c-4088-b8c9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'appleid-login.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-dcd0-45b9-b34f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'arc-remboursement.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-9f70-4c59-abfc-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'asianporn.se']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-ec34-46f1-8cf7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'asibon.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-ec58-41bf-ab5e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'b-cbd.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-5f1c-485c-ab29-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'barclays-security.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-d144-47de-bbc6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'basefundx.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-30ac-4c9c-974f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bbdnx.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-68e0-47a0-9f69-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bbvacps.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcd-4524-4d03-892f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:01.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:01.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bengira.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-3024-4153-b72d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bflcu.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-5cfc-4e73-bbbc-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bincbnk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-3c20-4345-97f6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'binckbk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-7d74-46a2-be94-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'binckbnk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-0b58-4693-9c87-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'binckbnkltd.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-7bf0-4dcc-b4ce-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bitpensure.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-0ea0-4047-a23c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'blessingstrade.bid']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-32e8-4fbe-a9c2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bncsan.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-70b8-4005-b76b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bongacumshow.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-6a08-4e8b-8e6c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'br-find.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-abd4-43ec-b326-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'brandhouseafrica.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-ce4c-4e29-85bf-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'broadviewbn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-cd3c-4bc6-aa4b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'building-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-394c-41c4-8a6d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'busok.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-e030-4cab-9670-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'bytominer.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-bf94-4238-b515-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'calbkn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-17d0-406b-a6de-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'camgirlfap.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-9a18-4633-9070-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'camshowvideos.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-51c8-4485-9c27-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'camstube.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-2a48-49d9-bac5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'capitalcoholdings.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-5ed4-454b-80ff-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'capitaldrop.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-a6cc-446c-9385-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'capitalfinancetrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-89f4-4a7f-bdb7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'capitalfinancialtrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-2498-48fb-8766-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'capitalinb.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-d478-4ac6-969b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'care-service.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-3a60-4586-9c9e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cbnkny.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-8898-4822-9204-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ccnpc.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-ed14-4de6-ab9f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cdes.edu.uy']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-4a88-44c0-9816-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'centrocienciaspenales.edu.py']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-a158-41b5-96ea-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'chaturbvideoshow.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-0638-498e-9c31-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'christianoifesi.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-0d34-4840-b151-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cicosatcolleges.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-143c-4b08-a3d8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cimbmsa.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-2db8-41c2-b77b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cimbmys.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-9334-4179-97d9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cnnu.top']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-efd8-4ffa-904b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cnsez.cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-59e8-4c71-8f27-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'code-finder.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-5e4c-441b-821d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'coderbox.sx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-9360-4966-bddc-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cognatefundtrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-05ec-4a2b-bfbe-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'coinbitcasino.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-106c-45b1-86ec-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-auth.in']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-41bc-4e2d-8a18-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-fmi.co']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-cd48-435d-b5e5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-i.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-742c-493f-b215-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-inlog.site']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-9234-445b-a9ab-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-location.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-73b0-4455-88d0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-login.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-2f88-4522-8901-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-mc.club']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-e350-4336-ac4d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-nc.club']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-e470-4450-94b5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-nmi.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-0fdc-4f21-9310-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-securitys.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-3144-4aa0-8989-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-signin.in']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-ec78-4482-a94b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-ua.club']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-7b88-4d60-b652-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-user.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-5d6c-481c-b554-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-znl.cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-40dc-4b03-bb76-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'com-znl.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-3b5c-4546-96c2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'commi.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-e9cc-4452-9467-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'constructora-ccicsa.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-6bf8-4d65-a8f7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'couplecamshows.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-1fdc-4fbe-9759-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'creativebrainsacademy.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-d3c0-455d-b9f9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'credfon.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-e9f8-4ba5-8f4a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'crlnl.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-e794-4e9b-a137-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'csasoporte.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-0750-41f9-8c8d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'cuom.com.mx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-28dc-4c41-9758-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'd0csign.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-7df8-45d7-929f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dailyvideo.se']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-a450-445a-9164-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'daneshkasra.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-604c-42ba-ad83-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'danmarkapotek.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-8304-46b0-b72b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'danskebnkltd.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-944c-4cd9-9dd2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'datasys365.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-2b90-49d8-8c91-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'davaocentralcollege.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-1708-4327-b9ec-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ddssnetdb.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-8160-442c-90b8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'deingenerator.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-c358-4710-877e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'deviceemporium.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-7cfc-429f-9318-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'devotella.club']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-83f8-42b4-a2c9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dggabogadosn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-5678-4c66-9fbb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'doktorsoffice.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-d2c8-4c59-8c2f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dou-fine.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-d48c-4047-964f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dramacool.pink']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-71ac-474d-98f5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'dsxlss.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-ec08-4fca-910b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'e-bdb.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dce-c80c-4496-8baf-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'e-fcu.ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-0a28-4374-add4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:02.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:02.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'earthglobalservice.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-e608-4e2b-a73c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'easylogocreations.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-0e9c-4fff-a995-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'elm-es.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-195c-4781-b021-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'empiresvault.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-5748-471a-add7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'en-cc.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-b08c-495d-9726-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'entrisb.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-5b98-454a-9ad6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'enxn.gdn']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-8878-49a3-a6b7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'eospace.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-2f78-4477-942a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'eph-stack.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-d97c-4588-bbff-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'eslifecover.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-f6fc-4f8f-9e52-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'espanabg.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-25ac-4321-9bc1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'eurosolvelimited.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-f9bc-4aeb-adab-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'factsmill.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-9358-4b00-a7ce-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fetlandia.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-ac8c-40d1-9589-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'findlocation.in']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1fe0-41ae-94d4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'flashpointy.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-3340-4845-bca6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'floxblog.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-a15c-44d5-8ffe-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fmi.services']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-c8c0-47c5-badb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fmilocation-icloud.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-6000-4cb0-b5fb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fnbnmn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-4c24-4176-a471-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fnbnzza.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-91a0-4f6b-bce4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'fnbznn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1984-40c3-8192-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'founded-icloud.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-17c4-4e10-bdb6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'gd0c.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-fbfc-4bcb-9ec2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'gdi-intl.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1b0c-4cc6-89e2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'gfxextranulled.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1a70-4fad-936c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'giddyuptv.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1994-46b8-8d24-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'girlycoolstuff.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-3180-40eb-9c1e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'globalfidelitylink.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-31d8-4c6f-97b8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'globalfundtrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-5c3c-42b8-9d92-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'gnosticserpent.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1edc-49fd-ba21-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'great-db.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-453c-4cb0-8d94-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'grindbot.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-db30-4387-8820-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hamsethengconsult.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-3e1c-436f-bedb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hccsi.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-9230-40b2-8d8f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hedgeft.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-1c2c-4337-ace9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hedgelenders.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-ed5c-45bb-ba61-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'helixgramslight.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-681c-417a-a337-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hentai.pink']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-9fac-401b-9401-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hentaionlinexx.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-a78c-4477-8435-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hmpg.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-4d18-44fb-b36c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hoaxer.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-fcb0-4e87-a4b7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'honeynhives.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-f5b8-4a4d-ba7f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hosting-offshore.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-5840-4a6f-9465-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'hsbc-security.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-78e0-4d53-9c70-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'i-inc.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-cdbc-481e-961d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'i-notify.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-41d8-41d5-ba9d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'iau-iau.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-a568-4f4a-8ef1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'icca-bbff.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-9448-47b9-853a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'icloud-certificate.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-dbdc-4574-aa68-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'icloud-log.in']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-11d4-452f-8490-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'icloud-support.fr']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-2bb4-45f6-a74b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'id-seguridad.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-bd1c-49c4-a13f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'idevicefindalert.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-0e10-4a24-9034-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'idmap.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-5220-4fea-83f1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ifindevices.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-7238-4a07-9a3c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ing-acces.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-b110-4248-8b57-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ing-retail.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-8864-43fc-8389-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ing-veiligacces.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-074c-4a56-a1fb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'institutopatria.com.mx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-3128-4e21-9390-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'interlinkdeliveryservices.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-0048-4ad8-a84f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'investing-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-6fb4-4b2c-8dac-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ios-m.ml']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-eb7c-4091-81c4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'itc.org.mx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-8068-4827-92e4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'itcuencadelpapaloapan.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-69b4-4857-aa11-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'jpmcbonline.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-b4cc-4df9-bcdf-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'kamagranorge.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-8ad0-400e-a41a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'kingsbruton.org.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dcf-74e4-430a-80f5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:03.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:03.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'klimeforum.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-5144-4c5a-bd72-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'krishnachildren.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-92b4-4abc-8904-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lasuave.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-4400-47fb-af71-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lcloud-map-ldevices.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-5bc8-44cb-8e41-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lcloud-map-support.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-250c-48f8-a8e2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'leakedz.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-fd20-4ddc-a68c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'limitlessheadwraps.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-9fb8-46d0-baca-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'linesex.co']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-2f90-4826-9668-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lloyds-online.group']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-8d68-4d59-b197-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lloydsbank-security.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-9144-4bcd-92c3-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'locate-apple.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-d630-447b-9482-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'locationsign.in']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-0848-4df7-be49-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'locationview-icloud.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-a568-4d98-84d8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'log-in.in']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-2f40-4add-b5c1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'logg-in.review']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-e9c0-4dad-b780-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'login-en.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-d7bc-4d90-b3f3-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lost-located.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-2fb8-4113-a6b0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lostdevicealert.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-0fe4-45ff-a4d2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'lostdevicelocated.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-9014-4312-a30a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'mahawebs.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-cddc-4bd5-8c7f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'malescumshow.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b5d8-4547-abac-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'manage-login.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-795c-4960-8ef1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'map-localisation.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-a618-41f4-869e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'marmaxxx.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-e428-464d-b7f8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'marythequeencollegeedu.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-30d0-4daf-be5d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'metrb.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-e308-404b-8dd1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'metrodumaguetecollege.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b540-4d72-8ad9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'mobilegameresources.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-16b8-4da3-8545-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'monarchft.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-acd0-4f74-b43a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'moodle.ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-2b14-47bb-81fc-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'mudragonoil.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-8668-42b9-ada8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nanuspiele.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-f4a8-4e39-a724-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'natgroponline.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-c5fc-4297-a1ea-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'natgrp-online.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-8518-42ce-9c53-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'negative-calorie-foods.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-f484-44ec-874f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'neopetsbeta.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-3bf8-4a83-bb76-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'netflix-accounts.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-f7f4-4d47-b9a5-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nethercase.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b3a8-48e7-9764-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'netserx.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-06c0-4f20-9acb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nfinservice.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-d39c-4655-85d7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nmeou.top']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-8200-4e15-8b0c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'noinkallowed.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-df9c-4e54-9fd7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'npcmstsfc.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b4ec-46cc-b5b6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nuoesaw.gdn']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-1c30-45f0-9703-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'nwbcldn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-6890-452a-be6e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'oldvidz.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-92d0-420c-8393-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'one2up-moviehd.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-7f98-4c24-9c47-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'onentris.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-c984-48e4-916e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'online-kamagra.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-6bb8-4364-9cec-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'orientfundtrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b3b0-4efc-85c6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'oumn.ml']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-0c74-4dd2-9937-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'p2p9.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-1048-4313-86de-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'pacificcbn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-2ce4-47e9-af7b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'pakket-omgevingskeuze.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-eebc-42c9-8354-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'paradiseinwords.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-83a8-4f68-aad7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'pcc-cdo.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-be58-482e-a3a3-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'phscandal.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-fad8-4ac2-825f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'pornmania.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-65d8-4201-9e6e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'potensmedelshop.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-197c-4bd3-b754-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'potenzmitteleu.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-febc-4072-b52e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'prize.today']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-cb20-4866-b68f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'profileworld.site']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-f11c-471f-9ce8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'profileworld.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-7044-4691-9ad6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'profundz.site']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-0f58-4c9c-a2db-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'proiptv.be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-8c0c-4fff-968d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'psybersec.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-84f8-4ca3-866c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'psyvpn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-3d70-44e7-a996-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'puritychambers.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-1460-4a8e-9511-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'pwuquezoncity.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-6850-4b76-8177-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'rb-shooting.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-596c-4f7c-ba4c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'redeemroblox.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-d5fc-4b3a-b536-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'reply-apple.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-3564-4dac-a206-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'retail-ing.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b5b8-4a72-9687-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'richgang.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-e640-480e-ab86-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'rssexpressservice.pw']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-27f8-44d9-b53a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'saews.ml']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-ce78-44f9-a8eb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'scbnkl.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-309c-41f9-95a9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'seabinproject.press']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-1b78-4ac2-a230-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'searchlttrn.bid']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-6cd0-4a7a-962d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'secured-americanexpress.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-b8b0-4ddd-a366-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'security-hsbc.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-43d8-4bc9-8d2c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'security-natwest.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-6650-4667-93d0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'seguridad-id.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-0454-4f80-b554-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'service-fmi.online']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd0-6740-4309-bc99-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:04.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:04.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'services-th.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-4b38-47f8-935b-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'shellpremium.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-5da4-4611-a1c6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'shirttoshoe.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-1cc4-49f0-b401-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'siegelineservices.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-2914-4a30-bcdf-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'sign-id.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-3bc8-4b3a-be84-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'signatureswiss.se']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-30cc-46b5-bb6a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'signi.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-c8b4-4f85-9405-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'signup.review']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-9fa4-48bf-bf2f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'silenthacks.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-e8c8-406c-ac1a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'skynetsecurity.services']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-fd0c-4bdd-93cb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'society-co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-3734-4443-a1ac-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'soertamnnemos.cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-969c-4957-9cd1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'springfinancialtrust.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-18a4-45ec-9245-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'spvbeonline.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-3580-4826-8df7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'stmarycollege.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-2cdc-4673-84a1-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'suporte-br.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-aea4-48fc-bd5a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'support-apple-fmi.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-3fa8-45ab-a6b8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'support-lostmode.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-ad60-4ec3-b54d-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'supprot-th.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-7258-466c-91cd-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'suusite.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-0624-40e7-aaab-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'swipes.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-dcf0-4ef7-96c0-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'taciau.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-6858-4589-8ba4-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'tarjoukset.pl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-aab4-4d41-afc6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'teamclassicmailer.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-0ecc-458f-be9e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'teen-vdo.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-c104-4bed-a2c3-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'telfort-acces.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-da5c-4075-8fc6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'themostwantedtmw.ch']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-2768-4a30-a8ad-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'thriveabs.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-1cd0-4698-a620-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'tnrockers.cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-5e24-4f9d-b928-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'tnrockers.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-6114-4ea7-82ba-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'transcamshow.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-ee94-4963-8704-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'tsmhouseagency.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-255c-439e-a294-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'tvartas.ga']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-eb1c-449c-97cb-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'twentytwoflips.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-6680-46df-8b68-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ubabgr.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-88f8-45f4-9560-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'ugrfp.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-4d04-4459-84fa-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unicuec.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-ddf4-46ec-a05e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'united-banki.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-92b4-484b-bda6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unitedfcdtunion.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-d4d0-43a8-9233-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unitedfcrdtunion.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-9d8c-4b2f-ada2-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unitedfctunion.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-eb74-432e-a1b7-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unitedfcunion.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-001c-471c-a19f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unitedfdctunion.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-99b8-4981-8689-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'unitedgroupbank.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-c4c8-42a8-a469-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'universidaducem.cr']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-7528-4a5e-b0af-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'urei.org.mx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-09b0-4bc1-9482-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'use-log.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-39d4-413a-9770-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'vanaraj.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-5a74-425a-884e-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'veilig-acces.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-e0ec-450e-a86a-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'velocitypk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-9aec-49bb-9cae-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'velocitypk.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-ea90-454b-b3cf-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'veniscls.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-a730-4263-b3b6-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'veriea.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-cb9c-4f94-8e9c-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'verificar-id.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-0778-416c-b622-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'vinsecurityservice.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-8c60-454f-bce9-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'vipcamjp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-c33c-4c6d-bc0f-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'weissprivate.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-0c60-4434-ab69-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'westfundz.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-8804-47a7-8aec-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'westmore.xyz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-ece4-4230-ba87-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'wlc-ormoc.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-a028-496e-bad8-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'zawae.gdn']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115dd1-fd58-490b-afab-60570acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:53:05.000Z",
|
||
|
|
"modified": "2018-06-01T14:53:05.000Z",
|
||
|
|
"description": "DomainTools Risk Score of 90 of higher",
|
||
|
|
"pattern": "[domain-name:value = 'zazuspiele.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:53:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115e30-3fa4-4dbf-b99f-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:54:40.000Z",
|
||
|
|
"modified": "2018-06-01T14:54:40.000Z",
|
||
|
|
"description": "Phishing Domain Host",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.157.63.185']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:54:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5b115f15-8ee8-4eb0-882f-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_comment": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "asn: 43350;categories: ['botnet'];first_seen_at: 2018-05-03;last_seen_at: 2018-06-01;ip: 93.157.63.185;cc: NL;feed: zeus_ip_blocklist_std;cidr: 93.157.62.0/23;rir: RI"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5b115f15-4178-4b68-b2ac-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_comment": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "ETPRO TROJAN FormBook CnC Checkin (POST)"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-b630-4c49-97e5-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[url:value = 'http://floxblog.ru/23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-1000-49b8-8d4a-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[domain-name:value = 'www.modemchasedcarf.life']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-5474-4254-821b-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[url:value = 'http://www.raboportal.com/keuze/logg.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-9150-44f5-bb41-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[url:value = 'http://modemchasedcarf.life/mh/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-72f4-44df-b198-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[url:value = 'eospace.pw/supportj/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-9500-48cf-ba1b-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[url:value = 'www.bartolini-system.net/vh1/PvqDq929BSx_A_D_M1n_a.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115f15-ce24-4154-8ebf-5aef0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:58:29.000Z",
|
||
|
|
"modified": "2018-06-01T14:58:29.000Z",
|
||
|
|
"description": "93.157.63.185: Enriched via the iprep module",
|
||
|
|
"pattern": "[domain-name:value = 'gst-interac.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T14:58:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5b115f3f-d450-4377-9e35-68fa0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T14:59:11.000Z",
|
||
|
|
"modified": "2018-06-01T14:59:11.000Z",
|
||
|
|
"first_observed": "2018-06-01T14:59:11Z",
|
||
|
|
"last_observed": "2018-06-01T14:59:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"autonomous-system--5b115f3f-d450-4377-9e35-68fa0acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"AS\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "autonomous-system",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "autonomous-system--5b115f3f-d450-4377-9e35-68fa0acd0835",
|
||
|
|
"number": 43350
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115fe1-936c-4956-bfdd-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:01:53.000Z",
|
||
|
|
"modified": "2018-06-01T15:01:53.000Z",
|
||
|
|
"description": "Enriched via VT for 93.157.63.185",
|
||
|
|
"pattern": "[url:value = 'http://kbfvzoboss.bid/alien/fre.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T15:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115fe1-de50-4293-af4a-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:01:53.000Z",
|
||
|
|
"modified": "2018-06-01T15:01:53.000Z",
|
||
|
|
"description": "Enriched via VT for 93.157.63.185",
|
||
|
|
"pattern": "[url:value = 'http://floxblog.ru/23=dseszxa09/uesew/ox/za/fre.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T15:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115fe1-1b34-438e-a731-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:01:53.000Z",
|
||
|
|
"modified": "2018-06-01T15:01:53.000Z",
|
||
|
|
"description": "Enriched via VT for 93.157.63.185",
|
||
|
|
"pattern": "[url:value = 'http://alphastand.win/alien/fre.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T15:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115fe1-cb4c-4d6c-b83c-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:01:53.000Z",
|
||
|
|
"modified": "2018-06-01T15:01:53.000Z",
|
||
|
|
"description": "Enriched via VT for 93.157.63.185",
|
||
|
|
"pattern": "[url:value = 'http://alphastand.top/alien/fre.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T15:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b115fe1-2450-4e66-879e-5fb80acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:01:53.000Z",
|
||
|
|
"modified": "2018-06-01T15:01:53.000Z",
|
||
|
|
"description": "Enriched via VT for 93.157.63.185",
|
||
|
|
"pattern": "[url:value = 'http://alphastand.trade/alien/fre.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T15:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5b11675c-2fc0-4507-82e1-69b00acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:33:48.000Z",
|
||
|
|
"modified": "2018-06-01T15:33:48.000Z",
|
||
|
|
"first_observed": "2018-06-01T15:33:48Z",
|
||
|
|
"last_observed": "2018-06-01T15:33:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5b11675c-2fc0-4507-82e1-69b00acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"Support Tool\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5b11675c-2fc0-4507-82e1-69b00acd0835",
|
||
|
|
"value": "https://jbxcloud.joesecurity.org/analysis/579783"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5b1160a0-3980-4132-8d2c-66c90acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2018-06-01T15:05:04.000Z",
|
||
|
|
"modified": "2018-06-01T15:05:04.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cd3dbdf4416db2c42359f8beaadd3527' AND file:hashes.SHA1 = 'e764fb3236a1c823b02af3f9ed6d0c7f9c79ad85' AND file:hashes.SHA256 = 'b182e4c1a7089188ecb534ff63a9ad5881b332dce76f839624eaa98efba78b13' AND file:hashes.SSDEEP = '1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG' AND file:x_misp_text = 'Loki, POSTs out to hxxp://floxblog[.]ru/23=dseszxa09/uesew/ox/za/fre.php' AND file:x_misp_state = 'Malicious']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-06-01T15:05:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|