{
  "type": "bundle",
  "id": "bundle--13c92751-df3d-5bc5-b3c4-56625f79e0c1",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-09-25T00:00:00.000Z",
      "modified": "2026-09-25T00:00:00.000Z",
      "name": "Vorant",
      "identity_class": "organization",
      "contact_information": "hello@vorant.io"
    },
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--f58b57f5-d5db-592e-9476-869fd700157c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Phish Watch No. 2: Our most common phishing lure came from domains that can't exist",
      "description": "Spam-trap findings 24 Sep - 31 Oct 2026. Callback phone numbers (no STIX object type exists for these): +18082300432, +18058916100, +18102214138.",
      "report_types": ["threat-report"],
      "published": "2026-11-03T00:00:00Z",
      "object_refs": [
        "indicator--97f607a6-e6d3-51f8-9e75-359e73876af4",
        "indicator--7b0e7b8a-8299-5a7f-89ba-ddae1c1b09e7",
        "indicator--28208017-a9b9-566f-896b-295df21f393b",
        "indicator--a7837ea2-97db-5f99-bc5f-48d10d69f3aa",
        "indicator--fd75a6a6-1ec3-533c-ae2d-f34d2f20a7b1",
        "indicator--16221e19-75c0-5bfd-98cd-f52a14e538c0",
        "indicator--878981ce-6d1a-5909-9df4-138fe14c51fe",
        "indicator--91d3ff7b-09f8-51bd-96b0-0c18ce4b8381",
        "indicator--81bfc756-8877-5548-85ec-17605b14d453",
        "indicator--5bc2832e-c804-5384-8403-73680441ea78",
        "indicator--4c8bd886-35e4-54a8-a98f-5bf7bf51aa88",
        "indicator--3f000dda-1923-548c-957e-4aaed29518ce",
        "indicator--c562cc63-14ea-5a5e-8afc-6be9350ed240",
        "indicator--77f1f60b-3dba-5d3e-b2c1-1b22cfd9efdf",
        "indicator--01add68e-0619-5a64-8f78-d3e0251dc1bf",
        "indicator--06cbfc95-2d46-5836-b84e-9c6c546904a8",
        "indicator--c62e7886-d1be-5e65-b764-920193d2873e",
        "indicator--8908b628-ea90-5e6b-9af1-b2ffef924a54",
        "indicator--9ca16c6a-ffd1-5cf7-bc0b-c59994afdc4d",
        "indicator--05ab6436-dbde-50d5-b56d-ffe4dd9b6a31",
        "indicator--d41dbfe2-bf2f-592d-b290-43f54ca8255e",
        "indicator--de8b2d30-8ca3-5aa7-904d-2bef5d26046a",
        "indicator--ebc548cc-07a4-530b-909c-2d839e32931d",
        "indicator--b3ab5ae9-372f-5b88-b4ec-6a2586192f3b",
        "indicator--7a7b2847-3208-5a98-8ff1-093d5ea5bbf6",
        "indicator--0b931882-397c-5a11-b28e-31e69c7e1bda",
        "indicator--f27a6d18-d45a-5360-bc13-d67dff72dc3f",
        "indicator--50cbcfe4-7902-5332-aa93-0e5f7812def4",
        "indicator--2a9f4b42-f317-5b8c-bac3-30c1f646309f",
        "indicator--12359abb-1376-5e43-860a-5b7ec14590be",
        "indicator--1299483c-33c6-5bfe-a66b-e300be9f5431",
        "indicator--ebcc1ea5-c0b7-5274-b27c-494e38e42df1",
        "indicator--343c13a2-5c34-5fc6-9b41-16485f4cd0b7",
        "indicator--a4fee3c5-ee7b-5e6d-a7b5-59e6bf9c428c",
        "indicator--be80e2d7-e535-56a0-9911-e5e56e982753",
        "indicator--6795d309-f146-5965-a001-cc79b4e0c6bb",
        "indicator--8aff65d1-0b7d-5d12-9c6c-3ee634b60213",
        "indicator--dbd52f01-554c-5b34-aa27-f04eff1a5226",
        "indicator--337c901e-70ec-519a-a9d6-e860847f88a8",
        "indicator--5f8c0155-99e2-5503-bb9b-e47370484e5d",
        "indicator--5a1319ad-6f60-5285-9450-b6fcc9525f2c",
        "indicator--cfff2d1d-3f5c-5bb1-a542-fd9ab2e72377",
        "indicator--e504bfa4-89e5-5c76-b33a-c466b12d4a6a",
        "indicator--187225e7-681a-5db3-8bff-c340c44e263e",
        "indicator--7133b872-8db3-5461-8580-e7a8953f8a0a",
        "indicator--03168a47-cd53-50c7-9779-afb75927fba0",
        "indicator--3dc095aa-a97f-529d-b956-3ccd2b9bb49c",
        "indicator--d6eb5aad-f997-5082-a182-b0cc68787d63",
        "indicator--a74d1030-c279-5c45-846b-eba09938c3ad",
        "indicator--9b8690f6-bee4-5c59-bdb8-5f69ab8c9de1",
        "indicator--26d72b81-1b2f-5cf0-b238-5baa0971634f",
        "indicator--a3bff43d-7ef4-5b97-9d17-ea7cdba25031",
        "indicator--7e68bcec-5ab4-5d1b-ad22-1ee84b0ce5e7",
        "indicator--130d7dbe-6154-5d90-a120-80ae1897033b",
        "indicator--8a058cb0-1472-5005-87aa-1ea1628c9abf",
        "indicator--18bcdffd-d8be-5292-91ae-a0695ff450d2",
        "indicator--bcd09d81-873d-5977-892a-10002ab33c18",
        "indicator--8b83c8bb-9a28-5a7f-a61f-637b0380ff40",
        "indicator--e57af1f2-1ade-5bb0-8c6f-205647ee8af1",
        "indicator--9bf2b462-727d-5db8-ae5e-3587e799ddab",
        "indicator--b146769e-5f88-573b-8a4b-f740fc64b6fd",
        "indicator--d1131fa0-e73f-50ae-8fff-5e461d282283",
        "indicator--dde7906f-f534-5260-b096-2379b4867f4f",
        "indicator--84ad9cdd-ff51-5f15-b052-d8b78323b088",
        "indicator--98e0d1c5-d68c-549f-ac43-1300f27742c4",
        "indicator--d93abae9-512e-5345-8402-50621d535e9b",
        "indicator--09f24013-7115-5429-9425-acab13b3e67c",
        "indicator--ec6d3854-7f73-5959-b916-68a54ee67086",
        "indicator--2f608723-8b5f-51ed-9baf-ff8014789e55",
        "indicator--3ee93cbd-814b-58be-bd70-568e2960c260"
      ],
      "external_references": [
        {
          "source_name": "Vorant",
          "url": "https://vorant.io/research/phish-watch-2026-10/"
        }
      ],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97f607a6-e6d3-51f8-9e75-359e73876af4",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: trykaramba.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'trykaramba.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b0e7b8a-8299-5a7f-89ba-ddae1c1b09e7",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: adeaseinc.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'adeaseinc.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28208017-a9b9-566f-896b-295df21f393b",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: truetrustline.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'truetrustline.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7837ea2-97db-5f99-bc5f-48d10d69f3aa",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: trustifyapp.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'trustifyapp.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd75a6a6-1ec3-533c-ae2d-f34d2f20a7b1",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: usa-sw.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'usa-sw.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16221e19-75c0-5bfd-98cd-f52a14e538c0",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: vipvnn.com",
      "description": "sent from 103.129.44.0/22",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'vipvnn.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--878981ce-6d1a-5909-9df4-138fe14c51fe",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake credit-card offer: running-far.org",
      "description": "sending domain",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'running-far.org']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake credit-card offer"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91d3ff7b-09f8-51bd-96b0-0c18ce4b8381",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake credit-card offer: gold-fx.com",
      "description": "sending domain",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'gold-fx.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake credit-card offer"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81bfc756-8877-5548-85ec-17605b14d453",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Life-insurance lead lure: gabinetedecobranza.com",
      "description": "sending domain",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'gabinetedecobranza.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Life-insurance lead lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bc2832e-c804-5384-8403-73680441ea78",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake Celsius claims portal: portals-claimnetwork.com",
      "description": "lure site",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'portals-claimnetwork.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake Celsius claims portal"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c8bd886-35e4-54a8-a98f-5bf7bf51aa88",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Loan lure: kandor.beauty",
      "description": "lure site",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'kandor.beauty']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Loan lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f000dda-1923-548c-957e-4aaed29518ce",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Form-relay crypto lure: www.id5967.pages.dev",
      "description": "Cloudflare Pages site",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'www.id5967.pages.dev']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c562cc63-14ea-5a5e-8afc-6be9350ed240",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Form-relay crypto lure: www.eventid4137.pages.dev",
      "description": "Cloudflare Pages site",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'www.eventid4137.pages.dev']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77f1f60b-3dba-5d3e-b2c1-1b22cfd9efdf",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake Ledger device check: address-secure-redirect.s3-website.eu-north-1.amazonaws.com",
      "description": "Amazon S3 website",
      "indicator_types": ["malicious-activity"],
      "pattern": "[domain-name:value = 'address-secure-redirect.s3-website.eu-north-1.amazonaws.com']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake Ledger device check"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01add68e-0619-5a64-8f78-d3e0251dc1bf",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Form-relay crypto lure: https://graph.org/Notification-506935-10-22",
      "description": "Telegraph page",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://graph.org/Notification-506935-10-22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06cbfc95-2d46-5836-b84e-9c6c546904a8",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Form-relay crypto lure: https://graph.org/DMK-10-25",
      "description": "Telegraph page",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://graph.org/DMK-10-25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c62e7886-d1be-5e65-b764-920193d2873e",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Form-relay crypto lure: https://te.legra.ph/UIMID-10-17",
      "description": "Telegraph page",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://te.legra.ph/UIMID-10-17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Form-relay crypto lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8908b628-ea90-5e6b-9af1-b2ffef924a54",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Vehicle-wrap job scam: https://forms.cloud.microsoft/r/JUiEYhFGc6",
      "description": "Microsoft Forms page",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://forms.cloud.microsoft/r/JUiEYhFGc6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Vehicle-wrap job scam"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ca16c6a-ffd1-5cf7-bc0b-c59994afdc4d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Paid-survey job scam: https://sw.run/WBamB",
      "description": "link shortener",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value = 'https://sw.run/WBamB']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Paid-survey job scam"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05ab6436-dbde-50d5-b56d-ffe4dd9b6a31",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): https://storage.googleapis.com/obsidianly/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/obsidianly/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d41dbfe2-bf2f-592d-b290-43f54ca8255e",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): https://storage.googleapis.com/midfielders/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/midfielders/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de8b2d30-8ca3-5aa7-904d-2bef5d26046a",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): https://storage.googleapis.com/bowly/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/bowly/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebc548cc-07a4-530b-909c-2d839e32931d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): https://storage.googleapis.com/silwasijwat/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/silwasijwat/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3ab5ae9-372f-5b88-b4ec-6a2586192f3b",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): https://storage.googleapis.com/regaloder/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/regaloder/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a7b2847-3208-5a98-8ff1-093d5ea5bbf6",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/xiwahd/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/xiwahd/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b931882-397c-5a11-b28e-31e69c7e1bda",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/qd4q896dssddd/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/qd4q896dssddd/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f27a6d18-d45a-5360-bc13-d67dff72dc3f",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/jpsee/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/jpsee/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50cbcfe4-7902-5332-aa93-0e5f7812def4",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/motivation-energy/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/motivation-energy/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a9f4b42-f317-5b8c-bac3-30c1f646309f",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/nxcbvhgdsfuye0e8f7/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/nxcbvhgdsfuye0e8f7/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12359abb-1376-5e43-860a-5b7ec14590be",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/wnct/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/wnct/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1299483c-33c6-5bfe-a66b-e300be9f5431",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): https://storage.googleapis.com/vsphere/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/vsphere/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebcc1ea5-c0b7-5274-b27c-494e38e42df1",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Free-gift survey lure: https://storage.googleapis.com/usales26/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/usales26/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Free-gift survey lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--343c13a2-5c34-5fc6-9b41-16485f4cd0b7",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus lure: https://storage.googleapis.com/pastifraw/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/pastifraw/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4fee3c5-ee7b-5e6d-a7b5-59e6bf9c428c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus lure: https://storage.googleapis.com/rplfdoe/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/rplfdoe/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be80e2d7-e535-56a0-9911-e5e56e982753",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake signature request: https://storage.googleapis.com/silk-fountain-tip-fdxylo3voz/",
      "description": "Google Cloud Storage bucket",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value LIKE 'https://storage.googleapis.com/silk-fountain-tip-fdxylo3voz/%']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake signature request"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6795d309-f146-5965-a001-cc79b4e0c6bb",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): storage\\.googleapis\\.com/[^/]+/[^/]+\\.html\\?act=cl&.*cid=422302",
      "description": "detection pattern for the bill's links",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value MATCHES 'storage\\\\.googleapis\\\\.com/[^/]+/[^/]+\\\\.html\\\\?act=cl&.*cid=422302']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8aff65d1-0b7d-5d12-9c6c-3ee634b60213",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): storage\\.googleapis\\.com/[^/]+/[^/]+\\.html#/.*(1626b9s|2e\\.31\\.36\\.32\\.36\\.62\\.39\\.73)",
      "description": "detection pattern for the broker's links",
      "indicator_types": ["malicious-activity"],
      "pattern": "[url:value MATCHES 'storage\\\\.googleapis\\\\.com/[^/]+/[^/]+\\\\.html#/.*(1626b9s|2e\\\\.31\\\\.36\\\\.32\\\\.36\\\\.62\\\\.39\\\\.73)']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbd52f01-554c-5b34-aa27-f04eff1a5226",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.47.238",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.47.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--337c901e-70ec-519a-a9d6-e860847f88a8",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.44.91",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.44.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f8c0155-99e2-5503-bb9b-e47370484e5d",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.44.93",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.44.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a1319ad-6f60-5285-9450-b6fcc9525f2c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.45.54",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.45.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cfff2d1d-3f5c-5bb1-a542-fd9ab2e72377",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.45.55",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.45.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e504bfa4-89e5-5c76-b33a-c466b12d4a6a",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.47.231",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.47.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--187225e7-681a-5db3-8bff-c340c44e263e",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.47.233",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.47.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7133b872-8db3-5461-8580-e7a8953f8a0a",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.47.234",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.47.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03168a47-cd53-50c7-9779-afb75927fba0",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus mail from 103.129.44.0/22: 103.129.47.235",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '103.129.47.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus mail from 103.129.44.0/22"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3dc095aa-a97f-529d-b956-3ccd2b9bb49c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 5.196.61.172",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '5.196.61.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6eb5aad-f997-5082-a182-b0cc68787d63",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 37.59.184.152",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '37.59.184.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a74d1030-c279-5c45-846b-eba09938c3ad",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 54.37.46.208",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '54.37.46.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b8690f6-bee4-5c59-bdb8-5f69ab8c9de1",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 5.196.175.127",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '5.196.175.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26d72b81-1b2f-5cf0-b238-5baa0971634f",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 51.178.172.175",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.178.172.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3bff43d-7ef4-5b97-9d17-ea7cdba25031",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 51.38.165.152",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.38.165.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e68bcec-5ab4-5d1b-ad22-1ee84b0ce5e7",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake cloud-storage bill (cid=422302): 51.77.185.108",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.77.185.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake cloud-storage bill (cid=422302)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--130d7dbe-6154-5d90-a120-80ae1897033b",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 51.79.168.14",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.79.168.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a058cb0-1472-5005-87aa-1ea1628c9abf",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 212.83.164.236",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '212.83.164.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18bcdffd-d8be-5292-91ae-a0695ff450d2",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 85.17.4.93",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '85.17.4.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcd09d81-873d-5977-892a-10002ab33c18",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 107.155.113.45",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '107.155.113.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b83c8bb-9a28-5a7f-a61f-637b0380ff40",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 212.95.50.67",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '212.95.50.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e57af1f2-1ade-5bb0-8c6f-205647ee8af1",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 37.72.170.238",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '37.72.170.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9bf2b462-727d-5db8-ae5e-3587e799ddab",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 66.165.236.82",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '66.165.236.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b146769e-5f88-573b-8a4b-f740fc64b6fd",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 66.165.236.86",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '66.165.236.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1131fa0-e73f-50ae-8fff-5e461d282283",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "GCS traffic broker (1626b9s): 51.38.79.140",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '51.38.79.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["GCS traffic broker (1626b9s)"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dde7906f-f534-5260-b096-2379b4867f4f",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus lure: 2001:41d0:601:1100::614d",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv6-addr:value = '2001:41d0:601:1100::614d']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84ad9cdd-ff51-5f15-b052-d8b78323b088",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus lure: 2001:41d0:602:2358::5126",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv6-addr:value = '2001:41d0:602:2358::5126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98e0d1c5-d68c-549f-ac43-1300f27742c4",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Casino-bonus lure: 2001:41d0:602:2358::9f74",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv6-addr:value = '2001:41d0:602:2358::9f74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Casino-bonus lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d93abae9-512e-5345-8402-50621d535e9b",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Free-gift survey lure: 148.113.180.219",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '148.113.180.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Free-gift survey lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09f24013-7115-5429-9425-acab13b3e67c",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Free-gift survey lure: 57.129.178.6",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '57.129.178.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Free-gift survey lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec6d3854-7f73-5959-b916-68a54ee67086",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake credit-card offer: 216.104.40.205",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '216.104.40.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake credit-card offer"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f608723-8b5f-51ed-9baf-ff8014789e55",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Fake credit-card offer: 66.165.236.99",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '66.165.236.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Fake credit-card offer"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ee93cbd-814b-58be-bd70-568e2960c260",
      "created_by_ref": "identity--7f1b1c6e-5c2a-4d0e-9d7a-2b9a4f1e6c01",
      "created": "2026-11-03T00:00:00.000Z",
      "modified": "2026-11-03T00:00:00.000Z",
      "name": "Life-insurance lead lure: 198.20.94.180",
      "description": "sending IP",
      "indicator_types": ["malicious-activity"],
      "pattern": "[ipv4-addr:value = '198.20.94.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "valid_from": "2026-11-03T00:00:00Z",
      "labels": ["Life-insurance lead lure"],
      "object_marking_refs": ["marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"]
    }
  ]
}