3411 lines
No EOL
104 KiB
JSON
3411 lines
No EOL
104 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2021-02-08",
|
|
"extends_uuid": "",
|
|
"info": "[CERT-FR] Infrastructure d'attaque du groupe cybercriminel TA505",
|
|
"publish_timestamp": "1613036752",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1613041212",
|
|
"uuid": "6021536f-a808-4b9c-8136-d7460aba047c",
|
|
"Orgc": {
|
|
"name": "CERT-FR_1510",
|
|
"uuid": "56bdf779-46f8-4353-bdf9-2bb95bce2212"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ff1f00",
|
|
"name": "fr-classif:non-classifiees=\"NON-CLASSIFIEES\""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "cossi:TLP=\"white\""
|
|
},
|
|
{
|
|
"colour": "#008e63",
|
|
"name": "cossi:RechercheSourceOuverte=\"Autorisee\""
|
|
},
|
|
{
|
|
"colour": "#00714f",
|
|
"name": "cossi:fiabilite=\"Bonne\""
|
|
},
|
|
{
|
|
"colour": "#c60750",
|
|
"name": "misp-galaxy:threat-actor=\"FIN11\""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"name": "misp-galaxy:threat-actor=\"TA505\""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"name": "osint:lifetime=\"perpetual\""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"name": "osint:certainty=\"50\""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Other",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "comment",
|
|
"uuid": "8a948ce0-c2c8-4e2a-8c67-73757b48474f",
|
|
"value": "R\u00e9sultats de l'investigation sur l'infrastructure d'attaque de TA505",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00ae7a",
|
|
"name": "DescriptionTechnique"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server [2020-11-29:]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "87ca8c58-8696-4752-8b62-34c714be0ec0",
|
|
"value": "135.181.97.81"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "be9d342e-4921-4e85-afd4-f8201e059fb0",
|
|
"value": "158.255.208.148"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "040b18be-531c-4297-bb5b-a69595c36d96",
|
|
"value": "158.255.208.168"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-07-31:2019-07-31]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "e69552e9-3236-4222-9cd3-10b0fddaa6dc",
|
|
"value": "176.121.14.112"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2019-07-17:2019-08-06]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "b50dda3c-65d6-4ff3-97ef-1ea1e2cdfffc",
|
|
"value": "176.121.14.132"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-09-20:2021-02-04]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "9e7b230e-24c3-4cab-a4e4-7e4646f0f080",
|
|
"value": "176.121.14.140"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-09-23:2019-10-01]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "abb56917-cdb2-4b03-bebe-a6f59ff126ff",
|
|
"value": "176.121.14.173"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server linked to TA505 activity [2020-03-06:2020-12-20]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "3b70dc09-21b1-4eb0-a928-cc5111f14d95",
|
|
"value": "176.121.14.175"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-03-11:2020-11-13], CobaltStrike C2 server potentially linked to TA505 activity [2020-03-13:2020-11-08]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "e944d50a-d898-42b4-a2b9-d4d8b2e1753b",
|
|
"value": "176.121.14.183"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-11-23:2020-11-26]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "a1c721c6-6f26-4145-a402-34c115b7a19b",
|
|
"value": "176.121.14.197"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-03-09:2020-05-16]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "b6267eb6-8a68-418b-bf0e-3eef8c759733",
|
|
"value": "176.121.14.199"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-04-12:2020-09-05]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "406df6c9-7eef-4e2f-a752-5c1de09e8dc7",
|
|
"value": "176.121.14.208"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-03-10:2020-12-22], CobaltStrike C2 server potentially linked to TA505 activity [2020-10-07:2020-10-07]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "cf8ea963-4fc6-49f6-b527-fa2369256ed0",
|
|
"value": "176.121.14.226"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-05-08:2020-05-08]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "45825169-fa00-4347-acd9-ce3b0b3373fc",
|
|
"value": "176.121.14.228"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-08-22:2021-01-31]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "8e7055a2-a143-4ee2-bc02-6395d2f5a5fa",
|
|
"value": "176.121.14.229"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-07-28:2020-08-06]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "a90b7ffe-659b-46dc-b65b-c04d677325c5",
|
|
"value": "176.121.14.231"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-10-09:2021-01-15]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "573d2e84-91f0-4146-96c1-5ce580b9aa70",
|
|
"value": "176.121.14.232"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-11-05:2020-11-27]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "354d0ab3-88c3-479b-8e20-b9aff14d42f8",
|
|
"value": "176.121.14.234"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2021-01-06:2021-01-14]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "1ffe4154-7123-43c8-9914-c36e5aa076e5",
|
|
"value": "176.121.14.235"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-08-19:2020-09-10], Metasploit C2 server potentially linked to TA505 activity [2020-03-21:2020-03-21]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "f9a1b32a-8919-41fe-91c9-51da8900a005",
|
|
"value": "176.121.14.237"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server linked to TA505 activity [2020-06-03:2020-12-16]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "7164c0cf-1fa7-4484-b659-2903679186e3",
|
|
"value": "176.121.14.238"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-03-21:2020-12-18]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "4dc60509-682a-44e0-a4fc-3c7461e6dd57",
|
|
"value": "176.121.14.241"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-10-06:2021-01-09]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "33b81673-0741-4553-99b6-f96ebf796c67",
|
|
"value": "176.121.14.249"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "CobaltStrike C2 server potentially linked to TA505 activity [2020-10-25:2021-01-30]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "b50afc63-83df-4712-be66-2bebed391e29",
|
|
"value": "176.121.14.251"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "60514e79-296d-493e-b924-fcd68d2bbf05",
|
|
"value": "185.17.121.188"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-10-07:2020-02-01]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "33026849-2e8a-4dbd-8c2b-9b3d84140214",
|
|
"value": "91.214.124.13"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-08-14:2019-10-15]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "ab65bc08-32bf-44a5-8d74-72315fa643ab",
|
|
"value": "91.214.124.18"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server linked to TA505 activity [2019-09-11:2020-02-07]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "f89233a1-20f2-4a3f-bc04-c1e90b988cb3",
|
|
"value": "91.214.124.20"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-10-04:2019-10-24]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "aeb40c17-e1dd-4fa8-9aa1-9183148ba5b3",
|
|
"value": "91.214.124.22"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server linked to TA505 activity [2019-12-19:2020-02-05]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "e431439f-cba2-4ccb-988b-7dddb175502c",
|
|
"value": "91.214.124.25"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-08-10:2019-11-03]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "1e7256d7-3aff-4b3c-b653-d8c7673fe2c5",
|
|
"value": "91.214.124.29"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server linked to TA505 activity [2019-07-31:2020-02-03]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "3e177ad5-6b94-4bc8-b772-4061d63d2c75",
|
|
"value": "91.214.124.5"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-09-03:2019-10-30]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "f2204f52-d094-4f88-b850-ef46031aca37",
|
|
"value": "91.214.124.53"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2019-08-04:2020-01-10]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "05c81d51-8984-4898-ae12-f8e9db99ad34",
|
|
"value": "91.214.124.54"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server potentially linked to TA505 activity [2020-01-29:2020-02-25]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "859590e6-313b-4b76-9e2a-a7653be3d90c",
|
|
"value": "91.214.124.57"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Metasploit C2 server linked to TA505 activity [2019-11-13:2020-01-15], CobaltStrike C2 server potentially linked to TA505 activity [2019-12-21:2020-01-23]",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "cb4ec068-2ce9-41cb-bb5d-441edb9f7958",
|
|
"value": "91.214.124.64"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "ip-dst",
|
|
"uuid": "b4e69725-e167-4a17-be0f-3e31750abd4f",
|
|
"value": "92.38.135.217"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1d90023f-6c6d-4caa-82f2-5f688c3aa6a9",
|
|
"value": "alpha-telemetry-microsoft.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ecb2b106-7ecb-4dcd-93e3-897043a7615c",
|
|
"value": "att-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "eebfa6e4-0031-4d51-8a5d-5852164e2ebb",
|
|
"value": "auxin-box.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "21a67340-19be-4865-891b-9444d4d69e35",
|
|
"value": "backup-place.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d654f256-aa41-4b06-bf68-7db5284e0ee5",
|
|
"value": "bak-home.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "279ef0ba-e00e-48ae-a59c-3eb61d5113ec",
|
|
"value": "bak0-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "79e1a58b-6406-4d53-9bd6-8f240837114f",
|
|
"value": "band-switch.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a7e201bb-4a05-4f02-9fc4-839f103e97c3",
|
|
"value": "box-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a4713845-ac4b-4a78-875b-fdf1650fbbac",
|
|
"value": "box-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "70db6701-037a-44b0-9c2f-fa393eecea11",
|
|
"value": "box-en-au.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3f51eb81-496f-48a1-b730-e8b3fa06cb92",
|
|
"value": "box-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c0072af5-6d80-430d-8b8e-1e4a60ef4132",
|
|
"value": "boxfiles-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "319bfce4-1b0b-4256-b551-8146097d251d",
|
|
"value": "boxrcdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "270b486b-3e52-4199-8e74-c653e900d244",
|
|
"value": "cdn-box.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "fee0967b-0a9f-4fa6-844b-5f7619cea2b7",
|
|
"value": "cdn-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796786",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d254c49f-3918-4f2d-a393-abf074d4a59f",
|
|
"value": "cdn-onedrive-live.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "bcb8878d-9773-48e8-b993-462e39940727",
|
|
"value": "clients-share.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "94c95735-a074-4364-a824-90e67cdcf381",
|
|
"value": "clietns-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a06f406e-7302-4666-b5b5-a92571a91095",
|
|
"value": "cloud-store-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "0b3e2cc1-f287-47c0-b6f2-bfcfb6a1b033",
|
|
"value": "clouds-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5eb3340d-b602-40b0-8175-81398b88eafd",
|
|
"value": "clouds-doanload-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "44de8360-a6b0-432c-87f4-512971037aaa",
|
|
"value": "clouds-share.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "b3f1e177-e34d-49f1-a403-dffa7c6fa27e",
|
|
"value": "corp-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "45fd1f4b-1f20-4429-a746-d4c2348f64d0",
|
|
"value": "corp-storage.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "924f20bd-8154-42c7-88cd-0dd0979bded1",
|
|
"value": "data-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c4843f3a-cd59-433c-b2ac-8f1b7c8100e1",
|
|
"value": "daumcdnf.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "403af9dc-5477-4d70-adea-fcd2304bac7a",
|
|
"value": "daumcdnr.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "4bad8ba3-5178-45a3-894f-3057f10538e8",
|
|
"value": "daumcdns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9890c8b9-aaf7-41a3-a9e7-12b3b096470a",
|
|
"value": "def-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "980c81f3-e780-4463-9731-cf83d355c25e",
|
|
"value": "definite-limits.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "286437b7-a58f-4d9f-8101-c61a0a673b4a",
|
|
"value": "digitals-space.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "96e25de7-fc29-4f29-a80b-ebb4b173c686",
|
|
"value": "direct-share.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "916ab6c2-c568-4efe-9c55-40c08049ecab",
|
|
"value": "direct-space.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "2915857f-b6b0-44c5-85fd-4a72b0771ec3",
|
|
"value": "direct-upt.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5162ae33-78d3-4112-8fbf-34d9d8b9b6b4",
|
|
"value": "dl-icloud.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "43ceaf6d-6d9e-4f44-a10c-ae650a513595",
|
|
"value": "dl-sharefile.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ea78b23d-0c6c-4bbd-b1b3-432d7e32c392",
|
|
"value": "dl-sync.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ada1b5cb-32a4-4b24-a60d-9372e55d1fd0",
|
|
"value": "docs-downloading.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "80319433-0eee-47f6-9bf4-fc600d13934b",
|
|
"value": "download-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "327c1ba1-a381-490c-b82b-f78261d88b69",
|
|
"value": "download-shares.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f6510191-8364-4e0a-ba79-cc5b98fb01d4",
|
|
"value": "downloads-links.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "b8649d50-42e2-4da5-a3ba-bdbab35172a5",
|
|
"value": "drm-google-analtyic.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "2c691f11-c9d4-498e-be07-0e368b402711",
|
|
"value": "drm-server-booking.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c7a8262c-8769-43ea-b680-9847df435fff",
|
|
"value": "drm-server13-login-microsoftonline.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1310e8ee-5470-41f0-b261-25f8ef4b73cb",
|
|
"value": "dropbox-cdnn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "28a1cb04-3bd5-420a-8e93-10e458fdab67",
|
|
"value": "dropbox-cdns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c0eee752-ad8e-43a5-a5a6-05a203799ed5",
|
|
"value": "dropbox-cdnt.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3a7cf6b5-6505-4f06-876e-460234b4b1cd",
|
|
"value": "dropbox-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "049819a6-f515-418f-ae8b-0791e5c54471",
|
|
"value": "dropbox-download-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "77e9a166-859d-4c1d-bc9c-83050e512442",
|
|
"value": "dropbox-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "cb8b17a0-2a6b-43ac-ab2f-f424ae8106b3",
|
|
"value": "dropbox-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9b309ece-8dff-4c12-a2b0-6a542b303ac2",
|
|
"value": "dropbox-er.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c174c903-973c-412d-b0f1-db21420b80ef",
|
|
"value": "dropbox-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ba5066f0-9af9-4a0d-b8fc-9a79ee999211",
|
|
"value": "dropbox-sdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "dc362b7a-0cd3-48b2-922a-7b3e77d99898",
|
|
"value": "dropboxccdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d1b245ab-8562-41d9-a398-96c2d4f1c19c",
|
|
"value": "dropboxrcdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6b1f6594-f757-4b13-8c98-1f4d4f90d481",
|
|
"value": "dropboxscdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5bd69ccc-3aa4-467e-bf46-7a64114a55f2",
|
|
"value": "dropboxwcdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "491d00be-9d4f-4b56-b547-2ae7b2b5cac4",
|
|
"value": "dyn-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "281bb75d-4489-44d4-890f-4bd1c740263e",
|
|
"value": "dysoool.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ed326b90-395a-4634-a88f-6b7a2e5f02b4",
|
|
"value": "egnytefs.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "849e5f07-f9fc-49c0-9cf8-6740ae8af400",
|
|
"value": "eu-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "e7147c71-3418-487b-8689-63b8db0d9575",
|
|
"value": "eu-global-online.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "e6f2b50b-ba16-473a-b1d7-26b7c0bd8a00",
|
|
"value": "eu-global.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1a623117-9834-43be-af23-3fcdc65febe5",
|
|
"value": "ex-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "949748c2-a635-4260-992b-2e1d94b8f1dc",
|
|
"value": "ex-stores.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "87c6dc36-162b-4fc4-a286-dff55b75d7c6",
|
|
"value": "facebook-drm-server3.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "34a8f9cf-762c-41ba-b4c1-eac62708dd7f",
|
|
"value": "fast-bits.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "73054c9d-c3ef-4de7-b339-128849ccc88d",
|
|
"value": "fast-gl-backups.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1be46a93-b950-48fe-a42f-e2b8d904dc87",
|
|
"value": "fasts-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c78dbee1-520d-4e00-8439-261934be3fe5",
|
|
"value": "file-shares.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "b97f726a-2bfa-4736-b27b-17bf9d179724",
|
|
"value": "files-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8f666e9a-635d-49be-9e6b-8eaf5696fe1e",
|
|
"value": "fileshare-cdns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ab94efd4-6dba-4b43-8b46-cf4fd60a3e34",
|
|
"value": "fileshare-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "e38205e6-2b49-463d-af76-52d46f08472f",
|
|
"value": "fileshare-storage.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9893de46-6972-4e6e-8746-d07cda98bbac",
|
|
"value": "filesharess.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "877be12a-afb7-463f-935e-15bfa2aeae6c",
|
|
"value": "filessz.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "38d6f0b3-8486-450b-87da-4dc8ea5b7534",
|
|
"value": "first-destin.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "2fd30988-e13a-4db8-8c8a-63aec004d62e",
|
|
"value": "fosdommtoi.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3d320cb1-66d2-4a71-a7c7-a94b4096555c",
|
|
"value": "general-lcfd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "dc01f983-990a-41b0-a2c6-2a9b30852df5",
|
|
"value": "geo-st-microsoft.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "26171675-e97c-4fd3-8b01-2b88538e71a9",
|
|
"value": "get-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6eaef210-9788-4f78-b55e-48bc2c6f2493",
|
|
"value": "get-hlinks.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8f289f69-8528-454f-8729-302b1be01a46",
|
|
"value": "getlink-service.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "7eccc282-19c3-4e3a-9f6a-c99c23d9ec42",
|
|
"value": "global-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9a36943e-1c3c-4efb-82e1-300f7f576a84",
|
|
"value": "global-logic-stl.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d8f34d4e-4679-401b-8863-4c7f6f74785f",
|
|
"value": "glr-ltd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "4dc9420d-d2a8-46d5-83a2-0e71a28d5600",
|
|
"value": "going-tr.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6a69044f-eb49-4aa3-8df8-c713f56a27e2",
|
|
"value": "google-eu-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "487f5f41-1573-4b4e-8b61-08dbc1b93cdf",
|
|
"value": "google-us-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "b71f6526-bc1f-4c62-90cd-19ef086af15d",
|
|
"value": "googledrive-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c06a0e3e-bb24-431f-894d-b9ab90812b6c",
|
|
"value": "googledrive-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "0d9ebc37-2db9-4e8b-a6b1-e4b0cd78da35",
|
|
"value": "googledrive-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f272b94f-90fa-4271-9cf5-1f34c9b4b14a",
|
|
"value": "googledrive-gb.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "110ad250-9355-4cfd-890d-aab17f9e4cd8",
|
|
"value": "groms-dat.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "705a3929-f729-440c-82c8-4008b45b1978",
|
|
"value": "home-storages.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "077b4ce8-8666-4901-ad61-55e4a72c3bd4",
|
|
"value": "i-sharecloud.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "27630fb5-2bdf-4e16-b3ba-962a2a79ec4c",
|
|
"value": "int-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "2f7df412-29ea-48ed-a612-e986d82a4c66",
|
|
"value": "integer-ms-home.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3d7324ff-ae65-4a9d-96fe-bf852e55f78e",
|
|
"value": "into-box.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "331c536d-b247-423d-9e31-b7ec3ad65a41",
|
|
"value": "jp-microsoft-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "204eca70-db1f-4cd1-bc88-6bf76aa8495b",
|
|
"value": "limo-ones.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ab74549d-9606-4514-b09c-47d84ba60d7c",
|
|
"value": "live-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "b8911d36-92c7-4237-9997-cfa9a3a7335f",
|
|
"value": "live-msr.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "7d5be3bb-da30-4d1b-89c5-190952432c2c",
|
|
"value": "local-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "df4d978d-bbc3-4b95-a389-76c6bed52b25",
|
|
"value": "long-space.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "0af623bf-90f4-415c-b358-dfe11818cda8",
|
|
"value": "main-boost.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "7444ed8f-5ded-458d-a788-2d638dbce8d7",
|
|
"value": "mainten-ferrum.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5d6dd13d-6511-40a1-937e-75bee78d289c",
|
|
"value": "mays-ltd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1b0c2559-56ca-4ec7-8f55-5e2ad9c58641",
|
|
"value": "md-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "201860f2-7dc8-4d03-a88b-3d1d6f1cd227",
|
|
"value": "mgrs-service.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c722913f-7d69-4bbd-bb74-477cf1cedb39",
|
|
"value": "microsoft-cnd-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6dbe7093-897b-469e-8fe0-e5087f7b2b44",
|
|
"value": "microsoft-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "eb0deaf2-cb08-467f-bbda-c55cfe0229a1",
|
|
"value": "microsoft-debug-098.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "29a4b230-198c-4de7-a48d-73f3207e8ac9",
|
|
"value": "microsoft-home-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "afcb44db-90f9-4b10-a948-5083f3dc6507",
|
|
"value": "microsoft-hub-us.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "4e93cfe7-da95-4da0-8a0c-9556e9a86887",
|
|
"value": "microsoft-live-us.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "71cddc3b-bab3-421d-990b-45229acd4a38",
|
|
"value": "microsoft-online-en-us.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "99263d59-3524-4cc7-9268-8465124f1acf",
|
|
"value": "microsoft-sback-server.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8b526e13-47fa-4d2d-8440-bf601732159c",
|
|
"value": "microsoft-store-drm-server.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "aa4db960-0406-43a5-a54c-cf0c3e01665a",
|
|
"value": "microsoft-store-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3ebdff6d-927e-4c9c-97f9-2f56c2a1568e",
|
|
"value": "microsoft-ware.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6963286b-36b0-48d0-81b0-16c87039a130",
|
|
"value": "mira-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d93311b6-f012-4508-9c70-436df6b8964c",
|
|
"value": "mop-shere.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1085a4ab-feb5-421f-9bd5-24c688583bdb",
|
|
"value": "ms-break.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "563d856d-fe14-4290-9260-605bfe36ffb4",
|
|
"value": "ms-debug-services.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "cea88c8f-bfb8-4b3b-89d8-83805098ad6b",
|
|
"value": "ms-downloading.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "216c02f3-b4fc-4ffd-80bf-0e82fcc6fa0f",
|
|
"value": "ms-en-microsoft.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "78d42db3-607e-4006-bc86-23bee7045d98",
|
|
"value": "ms-global-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1f945566-12c6-43eb-810a-060d20ec97c6",
|
|
"value": "ms-home-live.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a09c2619-097f-474c-9c0d-66fec222ea95",
|
|
"value": "ms-home-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d3e96fb1-0c38-4921-926b-3d52dd2f5749",
|
|
"value": "ms-pipes-service.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "746fb811-f903-4220-a178-1603c4e06aab",
|
|
"value": "ms-rdt.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "19cb2a93-7913-4294-b8fe-9b2121dbeb4a",
|
|
"value": "ms-upgrades.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1232088c-f161-4d2c-893f-95946936f8a4",
|
|
"value": "mslinks-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f00a8fd2-441b-44b5-9ab9-59feb5c98a8b",
|
|
"value": "msonebox.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "66c2803c-2883-4602-a767-fa54567820cd",
|
|
"value": "music-server11-facebook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "966576dd-109a-48e1-a808-b987391a2d64",
|
|
"value": "music-server17-facebook.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3453ee9d-f3d5-4c2f-87a4-28a3a99d9e25",
|
|
"value": "near-back.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "1014abb6-a9c0-48b3-b737-589397f750cb",
|
|
"value": "near-fast.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c4577ed2-9020-49c2-af8a-4c4e2a61b7e6",
|
|
"value": "nellscorp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "13272437-840e-49d1-a29d-f48964afd06a",
|
|
"value": "nels-ltd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "70ac9e39-34e0-44cd-b32f-274022fea697",
|
|
"value": "news-37876-mshome.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a93888e2-a982-4054-acef-a41bf4ac56db",
|
|
"value": "news-389767-mshome.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "e4883120-f95b-49a7-9d9f-23e62ef1a850",
|
|
"value": "news-server-drm-google.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ec60a434-a1b6-49e6-ac3d-959284ce5820",
|
|
"value": "news-server17-yahoo.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8c0e46ce-ad69-4fab-95ce-ae5e9a31f8b6",
|
|
"value": "nffsd-corp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "91d3a44a-b496-4131-8440-d8ba0d17c2e0",
|
|
"value": "none-class.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8d99b59c-7edf-455c-a65e-38289236a39f",
|
|
"value": "office-en-service.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8a0fd45c-bd77-42d8-a031-f2529e2b48bf",
|
|
"value": "office-teml-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796787",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "e508f088-22cf-4f96-a020-a284f9ffe403",
|
|
"value": "office365-en-gb.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a1381522-74d5-4416-aa07-d2b74bd15db7",
|
|
"value": "office365-eu-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d3059cb1-00d6-4b0a-98f9-32485920bdb2",
|
|
"value": "office365-update-en-gb.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "20f9819d-19b6-4a70-a6c5-066aea3717ef",
|
|
"value": "office365-update-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c5c300b9-a910-4621-a408-d369590b6648",
|
|
"value": "office365-update-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f615e85c-d9c8-46c8-ae69-bca701ef793d",
|
|
"value": "office365-us-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "fbb185f3-908f-4595-8710-479d1bc974f7",
|
|
"value": "one-drive-ms.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "de6b033b-b16c-4c6e-964d-80c88d2bd768",
|
|
"value": "one-drive-storage.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c71cdb20-f1bd-45b8-9482-745b7eb96e37",
|
|
"value": "one-drives.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "db3230d6-2a1a-42b8-a36c-000ba704f17c",
|
|
"value": "onedrive-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ad75b6d3-a2ff-46d0-99cf-01f1e5b07cec",
|
|
"value": "onedrive-download-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d7c6b9fb-59c6-435b-b074-793aadefa58c",
|
|
"value": "onedrive-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "adde785f-ae58-48eb-b7f7-a713495462da",
|
|
"value": "onedrive-en-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c723c1df-2176-49af-815d-c06e8b3ebe25",
|
|
"value": "onedrive-en-live.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "40e6352b-05c6-4127-8f44-3ea93cb7ad7a",
|
|
"value": "onedrive-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6008f4ff-590e-4d7e-b860-aabf07ca113f",
|
|
"value": "onedrive-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "135b3903-2ac7-4720-9b49-5df80547da32",
|
|
"value": "onedrive-fn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f42f63bd-90bb-45b4-bdb2-91f1f87d1536",
|
|
"value": "onedrive-live-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a1f4e0f9-63a6-4043-b5bb-7db43c279124",
|
|
"value": "onedrive-sd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5ff94453-32df-4d5e-a823-aba6173dfe90",
|
|
"value": "onedrive-sdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "bb01deae-c853-475e-b41b-e32de66bd6a7",
|
|
"value": "onedrive-sn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d5f54335-48fc-4232-b274-8907a18d992b",
|
|
"value": "onedrive-us-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a8cbe746-b257-4303-9095-d134c234bad6",
|
|
"value": "onedrives-en-live.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c3b293fa-433d-4cc5-a19c-2d94702d906b",
|
|
"value": "onehub-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "583ba885-a198-4244-9672-7bc53506e304",
|
|
"value": "onehub-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "37446d9d-77e2-4f93-9477-db61d49f0d26",
|
|
"value": "onesdrives.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "825b9570-8f5b-48df-aa2d-0488a547c794",
|
|
"value": "online-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "fcc71c9c-cb6e-487f-8618-7fe240393042",
|
|
"value": "onms-home.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a3ef75e3-bfea-47dc-96a6-62655a5a661a",
|
|
"value": "own-eu-cloud.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d7f314f6-a53a-493d-a2c6-cc8d77eebe39",
|
|
"value": "owncloud-cdn.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "efa9945c-5d17-4c4e-8c30-39e4b25c5549",
|
|
"value": "personal-dss.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "84116ca4-7235-4145-a546-5f9c39f7c4e2",
|
|
"value": "pssd-ltdgroup.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d2e94335-cd64-446d-aa2b-0e72836a9600",
|
|
"value": "rapid-stores.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f6943d8c-bbd1-48f0-b097-c1ce12c30a53",
|
|
"value": "rdmsom.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "97987d4c-9d64-4ca9-8391-f839f800de9a",
|
|
"value": "res-backup.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d9f328fe-103b-4eee-bb47-70aae84ff8d0",
|
|
"value": "reselling-corp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3b5fd2c0-f5af-4535-b552-9aeee29d1775",
|
|
"value": "river-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "50ae9894-2c2e-4b57-86df-cea9438d7d9e",
|
|
"value": "rmt-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "b19eda69-c864-4348-ae04-feceeaf4961c",
|
|
"value": "s3-ap-southeast-1-amazonaws.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "cc36580f-4e41-4310-baef-02b7eedb8c45",
|
|
"value": "s3-ap-southeast-2-amazonaws.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "faf36a80-8e61-453b-91c7-71558cbb6118",
|
|
"value": "s77657453-onedrive.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9122a13b-feae-4100-9ee3-d85363d32a16",
|
|
"value": "s89065339-onedrive.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "10a0afe6-5896-465a-8b78-8ac2a04f3e15",
|
|
"value": "sdff-corp.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f17e23d8-5285-4d60-82aa-909b12dfd974",
|
|
"value": "see-back.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "149e186a-40c4-4b2a-8e24-724a8dd42df3",
|
|
"value": "selling-group.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9510d97b-f690-426b-8cb2-c2d2b924863d",
|
|
"value": "share-clouds.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6c315d59-c7de-45a5-b1ee-703ef2674867",
|
|
"value": "share-downloading.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "58cd6b51-b2b4-409b-aae4-4bcb8a7e8c17",
|
|
"value": "share-stores.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "39f186e0-4438-4456-956a-1d3172287bf8",
|
|
"value": "shared-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6b58b0d3-95b2-499b-a14f-a39342b38b00",
|
|
"value": "shared-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c50d67d5-8d48-4376-ab2b-3b6f3981f545",
|
|
"value": "shared-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "891adab1-b306-48d7-a362-c4cef5186097",
|
|
"value": "shared-filez.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "649dfe20-01e7-49cb-8995-dbb4491d430f",
|
|
"value": "sharefile-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6d005320-243a-44eb-9e9b-d70775bff832",
|
|
"value": "sharefile-us.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a323f941-3830-4413-9737-881ffc79f611",
|
|
"value": "sharefiles-download.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "0f5be515-6bd4-4895-b50d-d84ec5ef56b7",
|
|
"value": "sharefiles-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "8a0cd3e7-98ac-454c-b429-6cbd7db01fb2",
|
|
"value": "sharefiles-eu.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c6829a70-e632-435c-afb7-5507b3fedb4c",
|
|
"value": "sharefileszz.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "7d341dea-7b91-4fae-970e-c3255f8efa72",
|
|
"value": "shares-cdns.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "100e31ae-42ce-462c-9e3a-e7d66051f37e",
|
|
"value": "shares-cloud.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3202a22e-f278-4d3f-bc7b-ee1a71b1cc33",
|
|
"value": "sharespoint-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "71ce0d9d-3dd9-41c7-8ab8-39275494c860",
|
|
"value": "short-share.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "daeec3f2-387e-479d-b7d4-09138264a693",
|
|
"value": "shortcut-links.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "0440b2cd-1e54-4bd2-a934-a034f5d7de67",
|
|
"value": "shr-links.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d97c9591-13f8-4d61-b73c-905ad3669f2d",
|
|
"value": "siron-del.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "71cea58c-54f5-4dae-ac79-ea2725814043",
|
|
"value": "sl-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "e0e5e230-ef8c-4397-b6d7-37dcc36b279f",
|
|
"value": "stat-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a40dc30e-6595-48c8-99a3-6886b23356b2",
|
|
"value": "static-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "39fb24ee-d9a7-461e-b7ec-3d817833ed8a",
|
|
"value": "static-google-analtyic.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "37f58b98-c27c-49f9-a0c4-759d1e44251d",
|
|
"value": "store-000846-live.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d43d2035-0f4a-44f2-9b75-8993b78ee308",
|
|
"value": "store-003774-live.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "be5a47d5-2b24-4e7d-9ca7-d12a8903690a",
|
|
"value": "store-downloads.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "dcb3339d-b618-4353-af77-038c43d1e1ee",
|
|
"value": "store-in-box.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "63c710c3-7b13-4013-8dc4-5b3aca57bcea",
|
|
"value": "stt-box.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "7a56449e-d654-47fa-8003-c576309a2e6b",
|
|
"value": "studio-stlsdr.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "84bf56ed-c534-4deb-b273-0e08ed3a53f5",
|
|
"value": "sync-share.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "cfe96d33-cf8d-4f73-9371-69b732a40a3d",
|
|
"value": "syncdownload.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c0125e0-1096-4eaa-a3d1-55b866214fd8",
|
|
"value": "syncdownloading.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a2b502d5-5079-4d0b-b49d-920e4fdf85b2",
|
|
"value": "tnrff-home.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "4333b250-f703-477c-ad6f-6cc62d18619d",
|
|
"value": "toppon-studio.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a0ea5c96-14ff-4d2e-8521-2cf364c197d3",
|
|
"value": "transff-reddon.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "eec88ef1-cd18-49fc-8f24-9f9603c5e2f7",
|
|
"value": "tremd-space.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "69c790a7-f177-438f-bb55-0eceb45d73d6",
|
|
"value": "update-ms-en-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a09fd416-189e-470c-9e0c-c5120c2fde33",
|
|
"value": "update-msoffice365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "f3c2487f-aa47-444c-a523-59c8c95dce2a",
|
|
"value": "update365-office-ens.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "85453fae-ac42-4c8c-8b1e-64b7ca26865e",
|
|
"value": "upgrade-ms-home.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "fae63b24-848a-4f96-963f-cf794b409cb0",
|
|
"value": "url-space.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6d1e5fe2-73b1-4f22-bbfd-55c1654ed15c",
|
|
"value": "us-microsoft-store.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a5770437-5177-449e-82f4-1fe891c220fd",
|
|
"value": "usr-telemetry-microsoft.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "d990532b-103c-4e5e-aab5-7cf0aaf4ebc6",
|
|
"value": "west-dat.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "65178575-e540-481c-ada1-e4532812d607",
|
|
"value": "windows-afx-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "152c5abd-c3e3-44ab-bdd9-d43f338e429b",
|
|
"value": "windows-appstore-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a10f90de-97f2-4f83-a570-b2e893f9eacb",
|
|
"value": "windows-avs-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Phishing server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "25bea186-6554-4572-a80f-73e0b81dd97b",
|
|
"value": "windows-cnd-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "aaac2105-b68c-4536-ba28-ccf4c618263d",
|
|
"value": "windows-dev-sec.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ffef09f2-a3ea-447f-bfeb-b8c4a00e6d56",
|
|
"value": "windows-en-us-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "ac828bf9-7906-4ac9-a4a7-b7c5b2afe4d2",
|
|
"value": "windows-fsd-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "eb10b758-589d-459d-8363-02d5398f814a",
|
|
"value": "windows-me-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "20d58ef7-4499-47ca-96c6-feb8db38e166",
|
|
"value": "windows-msd-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "479746a1-000e-4131-aa3a-2c1c832748e9",
|
|
"value": "windows-office365.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "66673f6d-7d31-451c-8a8b-006eb1f10f4d",
|
|
"value": "windows-se-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "13fb01b4-1e24-496e-a187-1b89e4137ab5",
|
|
"value": "windows-service-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "32ea38ba-4a06-4a11-a534-47592f7ace54",
|
|
"value": "windows-service-us.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "7603e35e-59f8-4242-84d9-3bc87cc37aa0",
|
|
"value": "windows-several-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "fbb48f8f-6ce3-40cf-9dab-9483295e19d1",
|
|
"value": "windows-sys-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "711c79f7-95db-4d80-995d-b6ef5aa1a20a",
|
|
"value": "windows-update-02-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "08da0d07-b91c-49fb-9c3d-4c9a646e04e8",
|
|
"value": "windows-update-sdbt.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "6ad242d2-e7ac-4372-869e-65c3692361d0",
|
|
"value": "windows-update-sdfw.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "fa660c7c-3cbf-4fb0-aec9-1eb4faa36469",
|
|
"value": "windows-update-sys.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "c242ae7e-0a50-4442-8b00-5b7ee1d493cc",
|
|
"value": "windows-upgrade-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "07c1a966-7237-4f8d-808d-78b1794b6be9",
|
|
"value": "windows-wsus-en.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "a176aa95-8fee-430e-b5fd-ece7b7776447",
|
|
"value": "windows-wsus-update.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "9306bc9d-4e12-4b74-a173-b03260ff806a",
|
|
"value": "wire-share.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "3babba64-d7d8-439c-9b06-76ba067373ce",
|
|
"value": "wpad-home.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Get2 C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "322d3a5e-505c-4180-a892-4f191275dd44",
|
|
"value": "xbox-en-cnd.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "SDBbot C2 server",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1612796788",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "aa4a79db-1fad-4142-ae37-b9313b6abdfc",
|
|
"value": "xbox-ms-store-debug.com"
|
|
}
|
|
]
|
|
}
|
|
} |