{
  "type": "bundle",
  "id": "bundle--2da32891-354e-421e-b5c3-f26969c746d0",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Vorant",
      "identity_class": "organization",
      "contact_information": "hello@vorant.io"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52c8eeea-20f8-4701-a5cb-414bd5ecd61f",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: suzinew.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'suzinew.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e09c328f-b1a5-4100-9883-9bdc6cddeb55",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: viprumors.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'viprumors.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa3daf3b-3e45-4d03-8315-fde610d02e88",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: nahenet.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'nahenet.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--181e9898-bc40-4fe6-b15e-18dc7c92a212",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: vipgamesonline.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'vipgamesonline.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91623715-5408-4b0c-aa89-a3f14a657696",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Form-relay crypto lure: kroxz.cc",
      "description": "Form-relay crypto lure",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'kroxz.cc']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--494aa61d-d11d-4950-8fc3-9f4ea83308f1",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Dating lure: nettiko.top",
      "description": "Dating lure",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'nettiko.top']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Dating lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--409a0825-46d6-4204-a926-4c39dccd53d0",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Form-relay crypto lure: www.transfer403.pages.dev",
      "description": "Cloudflare Pages",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'www.transfer403.pages.dev']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06377a40-1fcc-4872-9ede-3997a29f6aed",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Form-relay crypto lure: www.transfer406.pages.dev",
      "description": "Cloudflare Pages",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'www.transfer406.pages.dev']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60803af1-2cf3-40bb-b66c-981ef640b24e",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Form-relay crypto lure: www.transfer409.pages.dev",
      "description": "Cloudflare Pages",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'www.transfer409.pages.dev']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81d21311-3037-431f-b51c-164639732aaf",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Form-relay crypto lure: future5000.pages.dev",
      "description": "Cloudflare Pages",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'future5000.pages.dev']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64ca24f0-40ce-4574-8f1c-99e10f165b1c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Form-relay crypto lure: https://graph.org/NEW-TRANSACTION-734018-07-30",
      "description": "Telegraph page",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://graph.org/NEW-TRANSACTION-734018-07-30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d27d26c-ea44-4c22-877e-3685127e45aa",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Fake payroll job: https://sw.run/yt5Nn",
      "description": "shortener",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://sw.run/yt5Nn']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Fake payroll job"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4e31a6d-0435-4740-a8da-04a5d2ddd581",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/salmonnais/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/salmonnais/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d49ed1e9-3d27-4a6f-9925-8202cc66b14c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/qd4q896dssddd/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/qd4q896dssddd/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6e79d22-5ed1-482a-bd68-776be653e773",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/stelladot/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/stelladot/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b188d22c-073f-43d1-ba34-a9d7a8e33b58",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/eeedxsxcwxhb1d5jjjjjjjj/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/eeedxsxcwxhb1d5jjjjjjjj/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8908de0-1594-44d1-a9f0-b74638e94c69",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/motivation-energy/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/motivation-energy/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61e0d4f5-fd82-4817-b68a-8a3e601de310",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/banicafehb1d5kdkxkowwadislsid/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/banicafehb1d5kdkxkowwadislsid/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1d0263c-1117-419a-ae6d-75dff0b33739",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/jhjh0jh0jh01jh01jh01jh0jh1hj1jhhjjhjhjhhjjhj/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/jhjh0jh0jh01jh01jh01jh0jh1hj1jhhjjhjhjhhjjhj/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--057619d2-6ed3-4d97-9d0a-3cc41064136d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/fgdfgdfgdfg/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/fgdfgdfgdfg/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c174d59e-05c3-4aa8-ad97-09d2888270ae",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/hableeeeq/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/hableeeeq/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3791acb6-6e94-453b-abe8-b25c34edd5af",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/emane/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/emane/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcd71e47-0ae5-404e-9897-483a2a359c51",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/wnct/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/wnct/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b150bdb6-f562-41c2-b153-ba35656c3cbe",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS affiliate redirector: https://storage.googleapis.com/obsidianly/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/obsidianly/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS affiliate redirector"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01b9e518-6ad8-4958-8c38-2bef867d690d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS affiliate redirector: https://storage.googleapis.com/bowly/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/bowly/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS affiliate redirector"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81f61fe3-752d-452f-94c7-68d762d711ec",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS redirector: https://storage.googleapis.com/usales26/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/usales26/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS redirector"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95010521-8ee4-412b-8e50-75a769b26ae8",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS redirector: https://storage.googleapis.com/ztcmfltzkqyjneshxx/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/ztcmfltzkqyjneshxx/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS redirector"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b53d7eb9-af01-488d-aa47-49f7c25aa7af",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): storage\\.googleapis\\.com/[^/]+/[^/]+\\.html#/.*(1626b9s|2e\\.31\\.36\\.32\\.36\\.62\\.39\\.73)",
      "description": "detection pattern for the broker's links",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value MATCHES 'storage\\\\.googleapis\\\\.com/[^/]+/[^/]+\\\\.html#/.*(1626b9s|2e\\\\.31\\\\.36\\\\.32\\\\.36\\\\.62\\\\.39\\\\.73)']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b500a182-0d26-46f0-a31e-af4368f0a389",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: 103.129.44.72",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.44.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93afbe86-809f-4c09-a1fb-f072e1679f52",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: 103.129.44.82",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.44.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--874e73ac-4c3d-45c1-8585-ca1cc7ef4bf2",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: 103.129.44.93",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.44.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19f01002-e4be-4748-a1f5-0fbc290f0432",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "RewardHub prize lure: 103.129.47.236",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.47.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["RewardHub prize lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a2b1e0eb-146b-4c19-89da-1b6d9a88a63b",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 51.79.168.14",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.79.168.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7ab0e7f-e34c-4857-b6df-b748e6d99a77",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 51.79.155.195",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.79.155.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e1452f6-8118-4163-a7fa-d1a6e7512a9a",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 54.37.50.255",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '54.37.50.255']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c72aa5c-e690-4475-bb6a-4ad7563201d1",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 54.37.46.208",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '54.37.46.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76fb208b-f527-43a8-9486-83316f468945",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 54.39.46.116",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '54.39.46.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdf1c886-486f-4a57-a58a-5dfa0bd886a3",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 15.235.72.110",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '15.235.72.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--94dc47e2-84a9-4ecf-8287-f4eeb66cafaf",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 142.44.139.95",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '142.44.139.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72a2e87f-a040-4f11-8008-b55215dedc8c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 37.59.220.132",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '37.59.220.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--02e602b5-5a37-4280-acc2-2ca50ab57e2a",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 194.163.138.3",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '194.163.138.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fff2f54c-b31d-437f-b56b-405dff985fdc",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 194.26.18.11",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '194.26.18.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--113bdc40-fe63-42ed-b1d6-e6f9a2c22ea7",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 66.206.8.246",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '66.206.8.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--922098b5-6a78-488f-9e78-572895b7c936",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 185.185.40.6",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '185.185.40.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d594f562-d4ba-4d92-bfaa-9919ea30979d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 78.31.69.33",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '78.31.69.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff2b7780-4363-4115-82b0-bedfc068737d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 95.211.68.150",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '95.211.68.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ee424c4-2a7b-459e-9a74-a57671c3b7c9",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 45.129.99.71",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '45.129.99.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f280080-6757-4ace-9aca-bc5abfa4b681",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 23.111.155.163",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '23.111.155.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c8e5ccf-faa3-4a2e-9161-d11f9049e923",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 172.245.32.5",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '172.245.32.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9fcc5973-5fa2-4e51-9c50-0361b682ce5a",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 199.193.115.20",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '199.193.115.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88bca448-4f0b-4bcc-b8cd-846dece28278",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 50.28.85.196",
      "description": "sending IP; short-lived VPS",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '50.28.85.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2bded3f6-e22e-4176-b344-22b788b93cc0",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-10-10T00:00:00.000Z",
      "modified": "2026-10-10T00:00:00.000Z",
      "name": "Direct-send spam/phishing: 185.14.29.115",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '185.14.29.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-09-25T00:00:00Z",
      "labels": ["Direct-send spam/phishing"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--a2280f5f-62ca-48c1-8e44-4fa43750b57e",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-10-10T00:00:00.000Z",
      "name": "Phish Watch No. 1: Real websites delivered one in six of the lures we trapped",
      "description": "Spam-trap findings 25 Aug - 24 Sep 2026. Callback phone numbers (no STIX object type exists for these): +18663180106, +18662040835, +18125529660, +18648563853, +18052406839, +18307433230. Corrected 2026-10-10: the indicators for avalian[.]online and newbook[.]cloud were withdrawn (both appear to be real organisations' own bulk-mail sending domains), and one sending address was added.",
      "report_types": ["threat-report"],
      "published": "2026-09-25T00:00:00Z",
      "object_refs": [
        "indicator--52c8eeea-20f8-4701-a5cb-414bd5ecd61f",
        "indicator--e09c328f-b1a5-4100-9883-9bdc6cddeb55",
        "indicator--aa3daf3b-3e45-4d03-8315-fde610d02e88",
        "indicator--181e9898-bc40-4fe6-b15e-18dc7c92a212",
        "indicator--91623715-5408-4b0c-aa89-a3f14a657696",
        "indicator--494aa61d-d11d-4950-8fc3-9f4ea83308f1",
        "indicator--409a0825-46d6-4204-a926-4c39dccd53d0",
        "indicator--06377a40-1fcc-4872-9ede-3997a29f6aed",
        "indicator--60803af1-2cf3-40bb-b66c-981ef640b24e",
        "indicator--81d21311-3037-431f-b51c-164639732aaf",
        "indicator--64ca24f0-40ce-4574-8f1c-99e10f165b1c",
        "indicator--2d27d26c-ea44-4c22-877e-3685127e45aa",
        "indicator--a4e31a6d-0435-4740-a8da-04a5d2ddd581",
        "indicator--d49ed1e9-3d27-4a6f-9925-8202cc66b14c",
        "indicator--b6e79d22-5ed1-482a-bd68-776be653e773",
        "indicator--b188d22c-073f-43d1-ba34-a9d7a8e33b58",
        "indicator--d8908de0-1594-44d1-a9f0-b74638e94c69",
        "indicator--61e0d4f5-fd82-4817-b68a-8a3e601de310",
        "indicator--e1d0263c-1117-419a-ae6d-75dff0b33739",
        "indicator--057619d2-6ed3-4d97-9d0a-3cc41064136d",
        "indicator--c174d59e-05c3-4aa8-ad97-09d2888270ae",
        "indicator--3791acb6-6e94-453b-abe8-b25c34edd5af",
        "indicator--bcd71e47-0ae5-404e-9897-483a2a359c51",
        "indicator--b150bdb6-f562-41c2-b153-ba35656c3cbe",
        "indicator--01b9e518-6ad8-4958-8c38-2bef867d690d",
        "indicator--81f61fe3-752d-452f-94c7-68d762d711ec",
        "indicator--95010521-8ee4-412b-8e50-75a769b26ae8",
        "indicator--b53d7eb9-af01-488d-aa47-49f7c25aa7af",
        "indicator--b500a182-0d26-46f0-a31e-af4368f0a389",
        "indicator--93afbe86-809f-4c09-a1fb-f072e1679f52",
        "indicator--874e73ac-4c3d-45c1-8585-ca1cc7ef4bf2",
        "indicator--19f01002-e4be-4748-a1f5-0fbc290f0432",
        "indicator--a2b1e0eb-146b-4c19-89da-1b6d9a88a63b",
        "indicator--f7ab0e7f-e34c-4857-b6df-b748e6d99a77",
        "indicator--4e1452f6-8118-4163-a7fa-d1a6e7512a9a",
        "indicator--0c72aa5c-e690-4475-bb6a-4ad7563201d1",
        "indicator--76fb208b-f527-43a8-9486-83316f468945",
        "indicator--bdf1c886-486f-4a57-a58a-5dfa0bd886a3",
        "indicator--94dc47e2-84a9-4ecf-8287-f4eeb66cafaf",
        "indicator--72a2e87f-a040-4f11-8008-b55215dedc8c",
        "indicator--02e602b5-5a37-4280-acc2-2ca50ab57e2a",
        "indicator--fff2f54c-b31d-437f-b56b-405dff985fdc",
        "indicator--113bdc40-fe63-42ed-b1d6-e6f9a2c22ea7",
        "indicator--922098b5-6a78-488f-9e78-572895b7c936",
        "indicator--d594f562-d4ba-4d92-bfaa-9919ea30979d",
        "indicator--ff2b7780-4363-4115-82b0-bedfc068737d",
        "indicator--6ee424c4-2a7b-459e-9a74-a57671c3b7c9",
        "indicator--2f280080-6757-4ace-9aca-bc5abfa4b681",
        "indicator--5c8e5ccf-faa3-4a2e-9161-d11f9049e923",
        "indicator--9fcc5973-5fa2-4e51-9c50-0361b682ce5a",
        "indicator--88bca448-4f0b-4bcc-b8cd-846dece28278",
        "indicator--2bded3f6-e22e-4176-b344-22b788b93cc0"
      ],
      "external_references": [
        {
          "source_name": "Vorant",
          "url": "https://vorant.io/research/phish-watch-2026-09/"
        }
      ],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    }
  ]
}