2023-04-21 13:25:09 +00:00
{
"Event" : {
"analysis" : "2" ,
"date" : "2021-02-08" ,
"extends_uuid" : "" ,
"info" : "[CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505" ,
"publish_timestamp" : "1613036752" ,
"published" : true ,
"threat_level_id" : "2" ,
"timestamp" : "1613041212" ,
"uuid" : "6021536f-a808-4b9c-8136-d7460aba047c" ,
"Orgc" : {
"name" : "CERT-FR_1510" ,
"uuid" : "56bdf779-46f8-4353-bdf9-2bb95bce2212"
} ,
"Tag" : [
{
"colour" : "#ff1f00" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#ffffff" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "cossi:TLP=\"white\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#008e63" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "cossi:RechercheSourceOuverte=\"Autorisee\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#00714f" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "cossi:fiabilite=\"Bonne\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#c60750" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "misp-galaxy:threat-actor=\"FIN11\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#0088cc" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "misp-galaxy:threat-actor=\"TA505\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#004646" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "type:OSINT" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#0071c3" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "osint:lifetime=\"perpetual\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#0087e8" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "osint:certainty=\"50\"" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
} ,
{
"colour" : "#ffffff" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
] ,
"Attribute" : [
{
"category" : "Other" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "comment" ,
"uuid" : "8a948ce0-c2c8-4e2a-8c67-73757b48474f" ,
"value" : "R\u00e9sultats de l'investigation sur l'infrastructure d'attaque de TA505" ,
"Tag" : [
{
"colour" : "#00ae7a" ,
2023-05-19 09:05:37 +00:00
"local" : "0" ,
"name" : "DescriptionTechnique" ,
"relationship_type" : ""
2023-04-21 13:25:09 +00:00
}
]
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server [2020-11-29:]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "87ca8c58-8696-4752-8b62-34c714be0ec0" ,
"value" : "135.181.97.81"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "be9d342e-4921-4e85-afd4-f8201e059fb0" ,
"value" : "158.255.208.148"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "040b18be-531c-4297-bb5b-a69595c36d96" ,
"value" : "158.255.208.168"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-07-31:2019-07-31]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "e69552e9-3236-4222-9cd3-10b0fddaa6dc" ,
"value" : "176.121.14.112"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2019-07-17:2019-08-06]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "b50dda3c-65d6-4ff3-97ef-1ea1e2cdfffc" ,
"value" : "176.121.14.132"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-09-20:2021-02-04]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "9e7b230e-24c3-4cab-a4e4-7e4646f0f080" ,
"value" : "176.121.14.140"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-09-23:2019-10-01]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "abb56917-cdb2-4b03-bebe-a6f59ff126ff" ,
"value" : "176.121.14.173"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server linked to TA505 activity [2020-03-06:2020-12-20]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "3b70dc09-21b1-4eb0-a928-cc5111f14d95" ,
"value" : "176.121.14.175"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-03-11:2020-11-13], CobaltStrike C2 server potentially linked to TA505 activity [2020-03-13:2020-11-08]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "e944d50a-d898-42b4-a2b9-d4d8b2e1753b" ,
"value" : "176.121.14.183"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-11-23:2020-11-26]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "a1c721c6-6f26-4145-a402-34c115b7a19b" ,
"value" : "176.121.14.197"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-03-09:2020-05-16]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "b6267eb6-8a68-418b-bf0e-3eef8c759733" ,
"value" : "176.121.14.199"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-04-12:2020-09-05]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "406df6c9-7eef-4e2f-a752-5c1de09e8dc7" ,
"value" : "176.121.14.208"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-03-10:2020-12-22], CobaltStrike C2 server potentially linked to TA505 activity [2020-10-07:2020-10-07]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "cf8ea963-4fc6-49f6-b527-fa2369256ed0" ,
"value" : "176.121.14.226"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-05-08:2020-05-08]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "45825169-fa00-4347-acd9-ce3b0b3373fc" ,
"value" : "176.121.14.228"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-08-22:2021-01-31]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "8e7055a2-a143-4ee2-bc02-6395d2f5a5fa" ,
"value" : "176.121.14.229"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-07-28:2020-08-06]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "a90b7ffe-659b-46dc-b65b-c04d677325c5" ,
"value" : "176.121.14.231"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-10-09:2021-01-15]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "573d2e84-91f0-4146-96c1-5ce580b9aa70" ,
"value" : "176.121.14.232"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-11-05:2020-11-27]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "354d0ab3-88c3-479b-8e20-b9aff14d42f8" ,
"value" : "176.121.14.234"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2021-01-06:2021-01-14]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "1ffe4154-7123-43c8-9914-c36e5aa076e5" ,
"value" : "176.121.14.235"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-08-19:2020-09-10], Metasploit C2 server potentially linked to TA505 activity [2020-03-21:2020-03-21]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "f9a1b32a-8919-41fe-91c9-51da8900a005" ,
"value" : "176.121.14.237"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server linked to TA505 activity [2020-06-03:2020-12-16]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "7164c0cf-1fa7-4484-b659-2903679186e3" ,
"value" : "176.121.14.238"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-03-21:2020-12-18]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "4dc60509-682a-44e0-a4fc-3c7461e6dd57" ,
"value" : "176.121.14.241"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-10-06:2021-01-09]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "33b81673-0741-4553-99b6-f96ebf796c67" ,
"value" : "176.121.14.249"
} ,
{
"category" : "Network activity" ,
"comment" : "CobaltStrike C2 server potentially linked to TA505 activity [2020-10-25:2021-01-30]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "b50afc63-83df-4712-be66-2bebed391e29" ,
"value" : "176.121.14.251"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "60514e79-296d-493e-b924-fcd68d2bbf05" ,
"value" : "185.17.121.188"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-10-07:2020-02-01]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "33026849-2e8a-4dbd-8c2b-9b3d84140214" ,
"value" : "91.214.124.13"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-08-14:2019-10-15]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "ab65bc08-32bf-44a5-8d74-72315fa643ab" ,
"value" : "91.214.124.18"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server linked to TA505 activity [2019-09-11:2020-02-07]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "f89233a1-20f2-4a3f-bc04-c1e90b988cb3" ,
"value" : "91.214.124.20"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-10-04:2019-10-24]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "aeb40c17-e1dd-4fa8-9aa1-9183148ba5b3" ,
"value" : "91.214.124.22"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server linked to TA505 activity [2019-12-19:2020-02-05]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "e431439f-cba2-4ccb-988b-7dddb175502c" ,
"value" : "91.214.124.25"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-08-10:2019-11-03]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "1e7256d7-3aff-4b3c-b653-d8c7673fe2c5" ,
"value" : "91.214.124.29"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server linked to TA505 activity [2019-07-31:2020-02-03]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "3e177ad5-6b94-4bc8-b772-4061d63d2c75" ,
"value" : "91.214.124.5"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-09-03:2019-10-30]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "f2204f52-d094-4f88-b850-ef46031aca37" ,
"value" : "91.214.124.53"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2019-08-04:2020-01-10]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "05c81d51-8984-4898-ae12-f8e9db99ad34" ,
"value" : "91.214.124.54"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server potentially linked to TA505 activity [2020-01-29:2020-02-25]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "859590e6-313b-4b76-9e2a-a7653be3d90c" ,
"value" : "91.214.124.57"
} ,
{
"category" : "Network activity" ,
"comment" : "Metasploit C2 server linked to TA505 activity [2019-11-13:2020-01-15], CobaltStrike C2 server potentially linked to TA505 activity [2019-12-21:2020-01-23]" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "cb4ec068-2ce9-41cb-bb5d-441edb9f7958" ,
"value" : "91.214.124.64"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "b4e69725-e167-4a17-be0f-3e31750abd4f" ,
"value" : "92.38.135.217"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1d90023f-6c6d-4caa-82f2-5f688c3aa6a9" ,
"value" : "alpha-telemetry-microsoft.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ecb2b106-7ecb-4dcd-93e3-897043a7615c" ,
"value" : "att-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "eebfa6e4-0031-4d51-8a5d-5852164e2ebb" ,
"value" : "auxin-box.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "21a67340-19be-4865-891b-9444d4d69e35" ,
"value" : "backup-place.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d654f256-aa41-4b06-bf68-7db5284e0ee5" ,
"value" : "bak-home.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "279ef0ba-e00e-48ae-a59c-3eb61d5113ec" ,
"value" : "bak0-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "79e1a58b-6406-4d53-9bd6-8f240837114f" ,
"value" : "band-switch.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a7e201bb-4a05-4f02-9fc4-839f103e97c3" ,
"value" : "box-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a4713845-ac4b-4a78-875b-fdf1650fbbac" ,
"value" : "box-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "70db6701-037a-44b0-9c2f-fa393eecea11" ,
"value" : "box-en-au.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3f51eb81-496f-48a1-b730-e8b3fa06cb92" ,
"value" : "box-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c0072af5-6d80-430d-8b8e-1e4a60ef4132" ,
"value" : "boxfiles-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "319bfce4-1b0b-4256-b551-8146097d251d" ,
"value" : "boxrcdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "270b486b-3e52-4199-8e74-c653e900d244" ,
"value" : "cdn-box.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "fee0967b-0a9f-4fa6-844b-5f7619cea2b7" ,
"value" : "cdn-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796786" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d254c49f-3918-4f2d-a393-abf074d4a59f" ,
"value" : "cdn-onedrive-live.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "bcb8878d-9773-48e8-b993-462e39940727" ,
"value" : "clients-share.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "94c95735-a074-4364-a824-90e67cdcf381" ,
"value" : "clietns-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a06f406e-7302-4666-b5b5-a92571a91095" ,
"value" : "cloud-store-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "0b3e2cc1-f287-47c0-b6f2-bfcfb6a1b033" ,
"value" : "clouds-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5eb3340d-b602-40b0-8175-81398b88eafd" ,
"value" : "clouds-doanload-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "44de8360-a6b0-432c-87f4-512971037aaa" ,
"value" : "clouds-share.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "b3f1e177-e34d-49f1-a403-dffa7c6fa27e" ,
"value" : "corp-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "45fd1f4b-1f20-4429-a746-d4c2348f64d0" ,
"value" : "corp-storage.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "924f20bd-8154-42c7-88cd-0dd0979bded1" ,
"value" : "data-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c4843f3a-cd59-433c-b2ac-8f1b7c8100e1" ,
"value" : "daumcdnf.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "403af9dc-5477-4d70-adea-fcd2304bac7a" ,
"value" : "daumcdnr.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "4bad8ba3-5178-45a3-894f-3057f10538e8" ,
"value" : "daumcdns.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9890c8b9-aaf7-41a3-a9e7-12b3b096470a" ,
"value" : "def-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "980c81f3-e780-4463-9731-cf83d355c25e" ,
"value" : "definite-limits.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "286437b7-a58f-4d9f-8101-c61a0a673b4a" ,
"value" : "digitals-space.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "96e25de7-fc29-4f29-a80b-ebb4b173c686" ,
"value" : "direct-share.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "916ab6c2-c568-4efe-9c55-40c08049ecab" ,
"value" : "direct-space.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "2915857f-b6b0-44c5-85fd-4a72b0771ec3" ,
"value" : "direct-upt.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5162ae33-78d3-4112-8fbf-34d9d8b9b6b4" ,
"value" : "dl-icloud.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "43ceaf6d-6d9e-4f44-a10c-ae650a513595" ,
"value" : "dl-sharefile.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ea78b23d-0c6c-4bbd-b1b3-432d7e32c392" ,
"value" : "dl-sync.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ada1b5cb-32a4-4b24-a60d-9372e55d1fd0" ,
"value" : "docs-downloading.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "80319433-0eee-47f6-9bf4-fc600d13934b" ,
"value" : "download-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "327c1ba1-a381-490c-b82b-f78261d88b69" ,
"value" : "download-shares.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f6510191-8364-4e0a-ba79-cc5b98fb01d4" ,
"value" : "downloads-links.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "b8649d50-42e2-4da5-a3ba-bdbab35172a5" ,
"value" : "drm-google-analtyic.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "2c691f11-c9d4-498e-be07-0e368b402711" ,
"value" : "drm-server-booking.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c7a8262c-8769-43ea-b680-9847df435fff" ,
"value" : "drm-server13-login-microsoftonline.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1310e8ee-5470-41f0-b261-25f8ef4b73cb" ,
"value" : "dropbox-cdnn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "28a1cb04-3bd5-420a-8e93-10e458fdab67" ,
"value" : "dropbox-cdns.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c0eee752-ad8e-43a5-a5a6-05a203799ed5" ,
"value" : "dropbox-cdnt.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3a7cf6b5-6505-4f06-876e-460234b4b1cd" ,
"value" : "dropbox-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "049819a6-f515-418f-ae8b-0791e5c54471" ,
"value" : "dropbox-download-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "77e9a166-859d-4c1d-bc9c-83050e512442" ,
"value" : "dropbox-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "cb8b17a0-2a6b-43ac-ab2f-f424ae8106b3" ,
"value" : "dropbox-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9b309ece-8dff-4c12-a2b0-6a542b303ac2" ,
"value" : "dropbox-er.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c174c903-973c-412d-b0f1-db21420b80ef" ,
"value" : "dropbox-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ba5066f0-9af9-4a0d-b8fc-9a79ee999211" ,
"value" : "dropbox-sdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "dc362b7a-0cd3-48b2-922a-7b3e77d99898" ,
"value" : "dropboxccdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d1b245ab-8562-41d9-a398-96c2d4f1c19c" ,
"value" : "dropboxrcdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6b1f6594-f757-4b13-8c98-1f4d4f90d481" ,
"value" : "dropboxscdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5bd69ccc-3aa4-467e-bf46-7a64114a55f2" ,
"value" : "dropboxwcdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "491d00be-9d4f-4b56-b547-2ae7b2b5cac4" ,
"value" : "dyn-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "281bb75d-4489-44d4-890f-4bd1c740263e" ,
"value" : "dysoool.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ed326b90-395a-4634-a88f-6b7a2e5f02b4" ,
"value" : "egnytefs.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "849e5f07-f9fc-49c0-9cf8-6740ae8af400" ,
"value" : "eu-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "e7147c71-3418-487b-8689-63b8db0d9575" ,
"value" : "eu-global-online.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "e6f2b50b-ba16-473a-b1d7-26b7c0bd8a00" ,
"value" : "eu-global.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1a623117-9834-43be-af23-3fcdc65febe5" ,
"value" : "ex-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "949748c2-a635-4260-992b-2e1d94b8f1dc" ,
"value" : "ex-stores.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "87c6dc36-162b-4fc4-a286-dff55b75d7c6" ,
"value" : "facebook-drm-server3.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "34a8f9cf-762c-41ba-b4c1-eac62708dd7f" ,
"value" : "fast-bits.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "73054c9d-c3ef-4de7-b339-128849ccc88d" ,
"value" : "fast-gl-backups.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1be46a93-b950-48fe-a42f-e2b8d904dc87" ,
"value" : "fasts-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c78dbee1-520d-4e00-8439-261934be3fe5" ,
"value" : "file-shares.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "b97f726a-2bfa-4736-b27b-17bf9d179724" ,
"value" : "files-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8f666e9a-635d-49be-9e6b-8eaf5696fe1e" ,
"value" : "fileshare-cdns.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ab94efd4-6dba-4b43-8b46-cf4fd60a3e34" ,
"value" : "fileshare-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "e38205e6-2b49-463d-af76-52d46f08472f" ,
"value" : "fileshare-storage.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9893de46-6972-4e6e-8746-d07cda98bbac" ,
"value" : "filesharess.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "877be12a-afb7-463f-935e-15bfa2aeae6c" ,
"value" : "filessz.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "38d6f0b3-8486-450b-87da-4dc8ea5b7534" ,
"value" : "first-destin.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "2fd30988-e13a-4db8-8c8a-63aec004d62e" ,
"value" : "fosdommtoi.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3d320cb1-66d2-4a71-a7c7-a94b4096555c" ,
"value" : "general-lcfd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "dc01f983-990a-41b0-a2c6-2a9b30852df5" ,
"value" : "geo-st-microsoft.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "26171675-e97c-4fd3-8b01-2b88538e71a9" ,
"value" : "get-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6eaef210-9788-4f78-b55e-48bc2c6f2493" ,
"value" : "get-hlinks.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8f289f69-8528-454f-8729-302b1be01a46" ,
"value" : "getlink-service.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "7eccc282-19c3-4e3a-9f6a-c99c23d9ec42" ,
"value" : "global-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9a36943e-1c3c-4efb-82e1-300f7f576a84" ,
"value" : "global-logic-stl.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d8f34d4e-4679-401b-8863-4c7f6f74785f" ,
"value" : "glr-ltd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "4dc9420d-d2a8-46d5-83a2-0e71a28d5600" ,
"value" : "going-tr.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6a69044f-eb49-4aa3-8df8-c713f56a27e2" ,
"value" : "google-eu-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "487f5f41-1573-4b4e-8b61-08dbc1b93cdf" ,
"value" : "google-us-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "b71f6526-bc1f-4c62-90cd-19ef086af15d" ,
"value" : "googledrive-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c06a0e3e-bb24-431f-894d-b9ab90812b6c" ,
"value" : "googledrive-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "0d9ebc37-2db9-4e8b-a6b1-e4b0cd78da35" ,
"value" : "googledrive-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f272b94f-90fa-4271-9cf5-1f34c9b4b14a" ,
"value" : "googledrive-gb.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "110ad250-9355-4cfd-890d-aab17f9e4cd8" ,
"value" : "groms-dat.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "705a3929-f729-440c-82c8-4008b45b1978" ,
"value" : "home-storages.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "077b4ce8-8666-4901-ad61-55e4a72c3bd4" ,
"value" : "i-sharecloud.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "27630fb5-2bdf-4e16-b3ba-962a2a79ec4c" ,
"value" : "int-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "2f7df412-29ea-48ed-a612-e986d82a4c66" ,
"value" : "integer-ms-home.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3d7324ff-ae65-4a9d-96fe-bf852e55f78e" ,
"value" : "into-box.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "331c536d-b247-423d-9e31-b7ec3ad65a41" ,
"value" : "jp-microsoft-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "204eca70-db1f-4cd1-bc88-6bf76aa8495b" ,
"value" : "limo-ones.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ab74549d-9606-4514-b09c-47d84ba60d7c" ,
"value" : "live-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "b8911d36-92c7-4237-9997-cfa9a3a7335f" ,
"value" : "live-msr.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "7d5be3bb-da30-4d1b-89c5-190952432c2c" ,
"value" : "local-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "df4d978d-bbc3-4b95-a389-76c6bed52b25" ,
"value" : "long-space.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "0af623bf-90f4-415c-b358-dfe11818cda8" ,
"value" : "main-boost.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "7444ed8f-5ded-458d-a788-2d638dbce8d7" ,
"value" : "mainten-ferrum.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5d6dd13d-6511-40a1-937e-75bee78d289c" ,
"value" : "mays-ltd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1b0c2559-56ca-4ec7-8f55-5e2ad9c58641" ,
"value" : "md-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "201860f2-7dc8-4d03-a88b-3d1d6f1cd227" ,
"value" : "mgrs-service.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c722913f-7d69-4bbd-bb74-477cf1cedb39" ,
"value" : "microsoft-cnd-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6dbe7093-897b-469e-8fe0-e5087f7b2b44" ,
"value" : "microsoft-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "eb0deaf2-cb08-467f-bbda-c55cfe0229a1" ,
"value" : "microsoft-debug-098.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "29a4b230-198c-4de7-a48d-73f3207e8ac9" ,
"value" : "microsoft-home-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "afcb44db-90f9-4b10-a948-5083f3dc6507" ,
"value" : "microsoft-hub-us.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "4e93cfe7-da95-4da0-8a0c-9556e9a86887" ,
"value" : "microsoft-live-us.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "71cddc3b-bab3-421d-990b-45229acd4a38" ,
"value" : "microsoft-online-en-us.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "99263d59-3524-4cc7-9268-8465124f1acf" ,
"value" : "microsoft-sback-server.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8b526e13-47fa-4d2d-8440-bf601732159c" ,
"value" : "microsoft-store-drm-server.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "aa4db960-0406-43a5-a54c-cf0c3e01665a" ,
"value" : "microsoft-store-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3ebdff6d-927e-4c9c-97f9-2f56c2a1568e" ,
"value" : "microsoft-ware.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6963286b-36b0-48d0-81b0-16c87039a130" ,
"value" : "mira-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d93311b6-f012-4508-9c70-436df6b8964c" ,
"value" : "mop-shere.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1085a4ab-feb5-421f-9bd5-24c688583bdb" ,
"value" : "ms-break.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "563d856d-fe14-4290-9260-605bfe36ffb4" ,
"value" : "ms-debug-services.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "cea88c8f-bfb8-4b3b-89d8-83805098ad6b" ,
"value" : "ms-downloading.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "216c02f3-b4fc-4ffd-80bf-0e82fcc6fa0f" ,
"value" : "ms-en-microsoft.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "78d42db3-607e-4006-bc86-23bee7045d98" ,
"value" : "ms-global-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1f945566-12c6-43eb-810a-060d20ec97c6" ,
"value" : "ms-home-live.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a09c2619-097f-474c-9c0d-66fec222ea95" ,
"value" : "ms-home-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d3e96fb1-0c38-4921-926b-3d52dd2f5749" ,
"value" : "ms-pipes-service.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "746fb811-f903-4220-a178-1603c4e06aab" ,
"value" : "ms-rdt.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "19cb2a93-7913-4294-b8fe-9b2121dbeb4a" ,
"value" : "ms-upgrades.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1232088c-f161-4d2c-893f-95946936f8a4" ,
"value" : "mslinks-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f00a8fd2-441b-44b5-9ab9-59feb5c98a8b" ,
"value" : "msonebox.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "66c2803c-2883-4602-a767-fa54567820cd" ,
"value" : "music-server11-facebook.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "966576dd-109a-48e1-a808-b987391a2d64" ,
"value" : "music-server17-facebook.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3453ee9d-f3d5-4c2f-87a4-28a3a99d9e25" ,
"value" : "near-back.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "1014abb6-a9c0-48b3-b737-589397f750cb" ,
"value" : "near-fast.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c4577ed2-9020-49c2-af8a-4c4e2a61b7e6" ,
"value" : "nellscorp.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "13272437-840e-49d1-a29d-f48964afd06a" ,
"value" : "nels-ltd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "70ac9e39-34e0-44cd-b32f-274022fea697" ,
"value" : "news-37876-mshome.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a93888e2-a982-4054-acef-a41bf4ac56db" ,
"value" : "news-389767-mshome.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "e4883120-f95b-49a7-9d9f-23e62ef1a850" ,
"value" : "news-server-drm-google.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ec60a434-a1b6-49e6-ac3d-959284ce5820" ,
"value" : "news-server17-yahoo.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8c0e46ce-ad69-4fab-95ce-ae5e9a31f8b6" ,
"value" : "nffsd-corp.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "91d3a44a-b496-4131-8440-d8ba0d17c2e0" ,
"value" : "none-class.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8d99b59c-7edf-455c-a65e-38289236a39f" ,
"value" : "office-en-service.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8a0fd45c-bd77-42d8-a031-f2529e2b48bf" ,
"value" : "office-teml-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796787" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "e508f088-22cf-4f96-a020-a284f9ffe403" ,
"value" : "office365-en-gb.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a1381522-74d5-4416-aa07-d2b74bd15db7" ,
"value" : "office365-eu-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d3059cb1-00d6-4b0a-98f9-32485920bdb2" ,
"value" : "office365-update-en-gb.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "20f9819d-19b6-4a70-a6c5-066aea3717ef" ,
"value" : "office365-update-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c5c300b9-a910-4621-a408-d369590b6648" ,
"value" : "office365-update-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f615e85c-d9c8-46c8-ae69-bca701ef793d" ,
"value" : "office365-us-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "fbb185f3-908f-4595-8710-479d1bc974f7" ,
"value" : "one-drive-ms.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "de6b033b-b16c-4c6e-964d-80c88d2bd768" ,
"value" : "one-drive-storage.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c71cdb20-f1bd-45b8-9482-745b7eb96e37" ,
"value" : "one-drives.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "db3230d6-2a1a-42b8-a36c-000ba704f17c" ,
"value" : "onedrive-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ad75b6d3-a2ff-46d0-99cf-01f1e5b07cec" ,
"value" : "onedrive-download-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d7c6b9fb-59c6-435b-b074-793aadefa58c" ,
"value" : "onedrive-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "adde785f-ae58-48eb-b7f7-a713495462da" ,
"value" : "onedrive-en-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c723c1df-2176-49af-815d-c06e8b3ebe25" ,
"value" : "onedrive-en-live.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "40e6352b-05c6-4127-8f44-3ea93cb7ad7a" ,
"value" : "onedrive-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6008f4ff-590e-4d7e-b860-aabf07ca113f" ,
"value" : "onedrive-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "135b3903-2ac7-4720-9b49-5df80547da32" ,
"value" : "onedrive-fn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f42f63bd-90bb-45b4-bdb2-91f1f87d1536" ,
"value" : "onedrive-live-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a1f4e0f9-63a6-4043-b5bb-7db43c279124" ,
"value" : "onedrive-sd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5ff94453-32df-4d5e-a823-aba6173dfe90" ,
"value" : "onedrive-sdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "bb01deae-c853-475e-b41b-e32de66bd6a7" ,
"value" : "onedrive-sn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d5f54335-48fc-4232-b274-8907a18d992b" ,
"value" : "onedrive-us-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a8cbe746-b257-4303-9095-d134c234bad6" ,
"value" : "onedrives-en-live.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c3b293fa-433d-4cc5-a19c-2d94702d906b" ,
"value" : "onehub-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "583ba885-a198-4244-9672-7bc53506e304" ,
"value" : "onehub-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "37446d9d-77e2-4f93-9477-db61d49f0d26" ,
"value" : "onesdrives.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "825b9570-8f5b-48df-aa2d-0488a547c794" ,
"value" : "online-office365.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "fcc71c9c-cb6e-487f-8618-7fe240393042" ,
"value" : "onms-home.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a3ef75e3-bfea-47dc-96a6-62655a5a661a" ,
"value" : "own-eu-cloud.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d7f314f6-a53a-493d-a2c6-cc8d77eebe39" ,
"value" : "owncloud-cdn.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "efa9945c-5d17-4c4e-8c30-39e4b25c5549" ,
"value" : "personal-dss.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "84116ca4-7235-4145-a546-5f9c39f7c4e2" ,
"value" : "pssd-ltdgroup.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d2e94335-cd64-446d-aa2b-0e72836a9600" ,
"value" : "rapid-stores.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f6943d8c-bbd1-48f0-b097-c1ce12c30a53" ,
"value" : "rdmsom.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "97987d4c-9d64-4ca9-8391-f839f800de9a" ,
"value" : "res-backup.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d9f328fe-103b-4eee-bb47-70aae84ff8d0" ,
"value" : "reselling-corp.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3b5fd2c0-f5af-4535-b552-9aeee29d1775" ,
"value" : "river-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "50ae9894-2c2e-4b57-86df-cea9438d7d9e" ,
"value" : "rmt-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "b19eda69-c864-4348-ae04-feceeaf4961c" ,
"value" : "s3-ap-southeast-1-amazonaws.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "cc36580f-4e41-4310-baef-02b7eedb8c45" ,
"value" : "s3-ap-southeast-2-amazonaws.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "faf36a80-8e61-453b-91c7-71558cbb6118" ,
"value" : "s77657453-onedrive.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9122a13b-feae-4100-9ee3-d85363d32a16" ,
"value" : "s89065339-onedrive.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "10a0afe6-5896-465a-8b78-8ac2a04f3e15" ,
"value" : "sdff-corp.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f17e23d8-5285-4d60-82aa-909b12dfd974" ,
"value" : "see-back.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "149e186a-40c4-4b2a-8e24-724a8dd42df3" ,
"value" : "selling-group.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9510d97b-f690-426b-8cb2-c2d2b924863d" ,
"value" : "share-clouds.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6c315d59-c7de-45a5-b1ee-703ef2674867" ,
"value" : "share-downloading.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "58cd6b51-b2b4-409b-aae4-4bcb8a7e8c17" ,
"value" : "share-stores.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "39f186e0-4438-4456-956a-1d3172287bf8" ,
"value" : "shared-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6b58b0d3-95b2-499b-a14f-a39342b38b00" ,
"value" : "shared-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c50d67d5-8d48-4376-ab2b-3b6f3981f545" ,
"value" : "shared-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "891adab1-b306-48d7-a362-c4cef5186097" ,
"value" : "shared-filez.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "649dfe20-01e7-49cb-8995-dbb4491d430f" ,
"value" : "sharefile-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6d005320-243a-44eb-9e9b-d70775bff832" ,
"value" : "sharefile-us.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a323f941-3830-4413-9737-881ffc79f611" ,
"value" : "sharefiles-download.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "0f5be515-6bd4-4895-b50d-d84ec5ef56b7" ,
"value" : "sharefiles-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "8a0cd3e7-98ac-454c-b429-6cbd7db01fb2" ,
"value" : "sharefiles-eu.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c6829a70-e632-435c-afb7-5507b3fedb4c" ,
"value" : "sharefileszz.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "7d341dea-7b91-4fae-970e-c3255f8efa72" ,
"value" : "shares-cdns.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "100e31ae-42ce-462c-9e3a-e7d66051f37e" ,
"value" : "shares-cloud.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3202a22e-f278-4d3f-bc7b-ee1a71b1cc33" ,
"value" : "sharespoint-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "71ce0d9d-3dd9-41c7-8ab8-39275494c860" ,
"value" : "short-share.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "daeec3f2-387e-479d-b7d4-09138264a693" ,
"value" : "shortcut-links.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "0440b2cd-1e54-4bd2-a934-a034f5d7de67" ,
"value" : "shr-links.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d97c9591-13f8-4d61-b73c-905ad3669f2d" ,
"value" : "siron-del.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "71cea58c-54f5-4dae-ac79-ea2725814043" ,
"value" : "sl-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "e0e5e230-ef8c-4397-b6d7-37dcc36b279f" ,
"value" : "stat-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a40dc30e-6595-48c8-99a3-6886b23356b2" ,
"value" : "static-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "39fb24ee-d9a7-461e-b7ec-3d817833ed8a" ,
"value" : "static-google-analtyic.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "37f58b98-c27c-49f9-a0c4-759d1e44251d" ,
"value" : "store-000846-live.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d43d2035-0f4a-44f2-9b75-8993b78ee308" ,
"value" : "store-003774-live.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "be5a47d5-2b24-4e7d-9ca7-d12a8903690a" ,
"value" : "store-downloads.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "dcb3339d-b618-4353-af77-038c43d1e1ee" ,
"value" : "store-in-box.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "63c710c3-7b13-4013-8dc4-5b3aca57bcea" ,
"value" : "stt-box.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "7a56449e-d654-47fa-8003-c576309a2e6b" ,
"value" : "studio-stlsdr.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "84bf56ed-c534-4deb-b273-0e08ed3a53f5" ,
"value" : "sync-share.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "cfe96d33-cf8d-4f73-9371-69b732a40a3d" ,
"value" : "syncdownload.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "5c0125e0-1096-4eaa-a3d1-55b866214fd8" ,
"value" : "syncdownloading.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a2b502d5-5079-4d0b-b49d-920e4fdf85b2" ,
"value" : "tnrff-home.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "4333b250-f703-477c-ad6f-6cc62d18619d" ,
"value" : "toppon-studio.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a0ea5c96-14ff-4d2e-8521-2cf364c197d3" ,
"value" : "transff-reddon.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "eec88ef1-cd18-49fc-8f24-9f9603c5e2f7" ,
"value" : "tremd-space.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "69c790a7-f177-438f-bb55-0eceb45d73d6" ,
"value" : "update-ms-en-office365.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a09fd416-189e-470c-9e0c-c5120c2fde33" ,
"value" : "update-msoffice365.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "f3c2487f-aa47-444c-a523-59c8c95dce2a" ,
"value" : "update365-office-ens.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "85453fae-ac42-4c8c-8b1e-64b7ca26865e" ,
"value" : "upgrade-ms-home.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "fae63b24-848a-4f96-963f-cf794b409cb0" ,
"value" : "url-space.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6d1e5fe2-73b1-4f22-bbfd-55c1654ed15c" ,
"value" : "us-microsoft-store.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a5770437-5177-449e-82f4-1fe891c220fd" ,
"value" : "usr-telemetry-microsoft.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "d990532b-103c-4e5e-aab5-7cf0aaf4ebc6" ,
"value" : "west-dat.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "65178575-e540-481c-ada1-e4532812d607" ,
"value" : "windows-afx-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "152c5abd-c3e3-44ab-bdd9-d43f338e429b" ,
"value" : "windows-appstore-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a10f90de-97f2-4f83-a570-b2e893f9eacb" ,
"value" : "windows-avs-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Phishing server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "25bea186-6554-4572-a80f-73e0b81dd97b" ,
"value" : "windows-cnd-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "aaac2105-b68c-4536-ba28-ccf4c618263d" ,
"value" : "windows-dev-sec.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ffef09f2-a3ea-447f-bfeb-b8c4a00e6d56" ,
"value" : "windows-en-us-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "ac828bf9-7906-4ac9-a4a7-b7c5b2afe4d2" ,
"value" : "windows-fsd-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "eb10b758-589d-459d-8363-02d5398f814a" ,
"value" : "windows-me-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "20d58ef7-4499-47ca-96c6-feb8db38e166" ,
"value" : "windows-msd-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "479746a1-000e-4131-aa3a-2c1c832748e9" ,
"value" : "windows-office365.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "66673f6d-7d31-451c-8a8b-006eb1f10f4d" ,
"value" : "windows-se-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "13fb01b4-1e24-496e-a187-1b89e4137ab5" ,
"value" : "windows-service-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "32ea38ba-4a06-4a11-a534-47592f7ace54" ,
"value" : "windows-service-us.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "7603e35e-59f8-4242-84d9-3bc87cc37aa0" ,
"value" : "windows-several-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "fbb48f8f-6ce3-40cf-9dab-9483295e19d1" ,
"value" : "windows-sys-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "711c79f7-95db-4d80-995d-b6ef5aa1a20a" ,
"value" : "windows-update-02-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "08da0d07-b91c-49fb-9c3d-4c9a646e04e8" ,
"value" : "windows-update-sdbt.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "6ad242d2-e7ac-4372-869e-65c3692361d0" ,
"value" : "windows-update-sdfw.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "fa660c7c-3cbf-4fb0-aec9-1eb4faa36469" ,
"value" : "windows-update-sys.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "c242ae7e-0a50-4442-8b00-5b7ee1d493cc" ,
"value" : "windows-upgrade-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "07c1a966-7237-4f8d-808d-78b1794b6be9" ,
"value" : "windows-wsus-en.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "a176aa95-8fee-430e-b5fd-ece7b7776447" ,
"value" : "windows-wsus-update.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "9306bc9d-4e12-4b74-a173-b03260ff806a" ,
"value" : "wire-share.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "3babba64-d7d8-439c-9b06-76ba067373ce" ,
"value" : "wpad-home.com"
} ,
{
"category" : "Network activity" ,
"comment" : "Get2 C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "322d3a5e-505c-4180-a892-4f191275dd44" ,
"value" : "xbox-en-cnd.com"
} ,
{
"category" : "Network activity" ,
"comment" : "SDBbot C2 server" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1612796788" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "aa4a79db-1fad-4142-ae37-b9313b6abdfc" ,
"value" : "xbox-ms-store-debug.com"
}
]
}
}
