{
  "id": "0d46927d-003d-4d7f-bc0d-3e85ca1411b9",
  "name": "PCAP verified workflow 2024-08-15 20260919",
  "description": "Explicit test workspace: real training capture; review remains draft. Not a production incident.",
  "status": "active",
  "domain": "enterprise-attack",
  "actor_ids": [],
  "technique_ids": [
    "T1010",
    "T1012",
    "T1014",
    "T1027",
    "T1033",
    "T1036",
    "T1050",
    "T1053",
    "T1055",
    "T1057",
    "T1059",
    "T1059.001",
    "T1059.003",
    "T1060",
    "T1063",
    "T1064",
    "T1070",
    "T1070.004",
    "T1071",
    "T1071.001",
    "T1082",
    "T1083",
    "T1087",
    "T1095",
    "T1105",
    "T1112",
    "T1113",
    "T1129",
    "T1204.001",
    "T1218",
    "T1218.010",
    "T1218.011",
    "T1496",
    "T1497",
    "T1518",
    "T1518.001",
    "T1542",
    "T1542.003",
    "T1553",
    "T1564",
    "T1564.001",
    "T1566",
    "T1574",
    "T1574.002"
  ],
  "report_ids": [
    "40c58a2f-b2de-4bff-8363-b060de19940e",
    "5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
    "691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
    "69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
    "dd60fb30-9c1f-4deb-80a8-83799e126691",
    "f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
  ],
  "evidence_nodes": [
    {
      "id": "log-pcap:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "type": "log-pcap-analysis",
      "label": "2024-08-15-traffic-analysis-exercise.pcap",
      "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2024-08-15-traffic-analysis-exercise.pcap\nCapture SHA-256: `e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c`\nSemantic result SHA-256: `f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab`\nAnalyzer manifest SHA-256: `ee952aeb7cdc6958f4ae5178c54c274a1e4f0aec4d42f3bdb95baaff063b3dde`\n\n## Executive summary\n\nDecoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 18189\n- Duration: 1962.204948 seconds\n- Captured bytes: 11674125\n- Endpoints: 75\n- Flows: 698\n\n## Deterministic findings\n\n### HIGH — Periodic HTTP callback pattern\n\nRepeated requests have a stable cadence consistent with automated callback or beacon behavior.\n\nRule: `periodic-http-callbacks@pcap-rules-v3`; confidence: 0.88; evidence: frame 11028 / TCP stream 142, frame 11505 / TCP stream 145, frame 11619 / TCP stream 151, frame 11688 / TCP stream 155, frame 11962 / TCP stream 164.\n\nMetrics: `{\"destination\":\"72.5.43.29\",\"host\":\"72.5.43.29\",\"median_absolute_deviation\":1.037,\"median_interval_seconds\":5.685,\"method\":\"GET\",\"port\":80,\"request_count\":303,\"source\":\"10.8.15.133\",\"uri\":\"/\"}`\n\n### LOW — Repeated unsuccessful DNS resolution\n\nRepeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.\n\nRule: `repeated-nxdomain@pcap-rules-v3`; confidence: 0.5; evidence: frame 56, frame 60, frame 962, frame 964, frame 2106.\n\nMetrics: `{\"domain\":\"wpad.lafontainebleu.org\",\"response_count\":20,\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 281 / TCP stream 11, frame 285 / TCP stream 11, frame 292 / TCP stream 11, frame 297 / TCP stream 11, frame 312 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":69,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 37 / TCP stream 0, frame 288 / TCP stream 19, frame 295 / TCP stream 19, frame 300 / TCP stream 19, frame 304 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":143,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1096 / TCP stream 1, frame 1098 / TCP stream 1, frame 1100 / TCP stream 1, frame 1102 / TCP stream 1, frame 1104 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.8.15.4\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.8.15.133\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 282 / TCP stream 11, frame 287 / TCP stream 11, frame 293 / TCP stream 11, frame 298 / TCP stream 11, frame 313 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":69,\"operation_numbers\":[\"0\",\"1\",\"12\",\"13\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.15.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 39 / TCP stream 0, frame 290 / TCP stream 19, frame 299 / TCP stream 19, frame 302 / TCP stream 19, frame 305 / TCP stream 19.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":113,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.8.15.4\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v3`; confidence: 0.95; evidence: frame 1097 / TCP stream 1, frame 1099 / TCP stream 1, frame 1101 / TCP stream 1, frame 1103 / TCP stream 1, frame 1105 / TCP stream 1.\n\nMetrics: `{\"destination\":\"10.8.15.133\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.8.15.4\"}`\n\n## ATT&CK candidates\n\n- T1071.001 Application Layer Protocol: Web Protocols (command-and-control), confidence=0.85, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `desktop-h8alzbv$`; client IPs: 10.8.15.133; frames: 151, 166, 169, 173, 187\n- account: `plucero`; client IPs: 10.8.15.133; frames: 975, 983, 985, 997, 1011\n- full-name: `Pierce Lucero`; client IPs: 10.8.15.133; frames: 1111\n- hostname: `DESKTOP-H8ALZBV`; client IPs: 10.8.15.133; frames: 1, 3, 5, 30, 58\n- netbios-group: `LAFONTAINEBLEU`; client IPs: unbound subject; frames: 31, 57, 103, 447\n\n## IOC and artifact candidates\n\n- domain: `a1834.dscg2.akamai.net`; roles: dns-cname\n- domain: `acroipm2.adobe.com`; roles: dns-query, http-host\n- domain: `api.msn.com`; roles: dns-query, tls-sni\n- domain: `app-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `armmf.adobe.com`; roles: dns-query, tls-sni\n- domain: `assets.msn.com`; roles: dns-query, tls-sni\n- domain: `blob.mwh03prdstf02a.store.core.windows.net`; roles: dns-cname\n- domain: `browser.events.data.msn.com`; roles: dns-query, tls-sni\n- domain: `business.bing.com`; roles: dns-query, tls-sni\n- domain: `business.checkfedexexp.com`; roles: dns-query, tls-sni\n- domain: `bzib.nelreports.net`; roles: dns-query, tls-sni\n- domain: `c-msn-com-nsatc.trafficmanager.net`; roles: dns-cname\n- domain: `c-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `c.bing.com`; roles: dns-query, tls-sni\n- domain: `c.msn.com`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `cxcs.microsoft.net`; roles: dns-query, tls-sni\n- domain: `default.exp-tas.com`; roles: dns-query, tls-sni\n- domain: `displaycatalog.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `dl-edge.smartscreen.microsoft.com`; roles: dns-query\n- domain: `dual-s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `ecn-us.dev.virtualearth.net`; roles: dns-query, tls-sni\n- domain: `ecs.office.com`; roles: dns-query, tls-sni\n- domain: `edge-consumer-static.azureedge.net`; roles: dns-query, tls-sni\n- domain: `edge-microsoft-com.dual-a-0036.a-msedge.net`; roles: dns-cname\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `edgeservices.bing.com`; roles: dns-query, tls-sni\n- domain: `fd.api.iris.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.msft.com.trafficmanager.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `g.live.com`; roles: dns-query, tls-sni\n- domain: `go.microsoft.com`; roles: dns-query, tls-sni\n- domain: `img-s-msn-com.akamaized.net`; roles: dns-query, tls-sni\n- domain: `img.s-msn.com`; roles: dns-query, tls-sni\n- domain: `licensing.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mobile.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `msedge.b.tlu.dl.delivery.mp.microsoft.com`; roles: dns-query, http-host\n- domain: `nav-edge.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `nav.smartscreen.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ntp.msn.com`; roles: dns-query, tls-sni\n- domain: `odc.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officeclient.microsoft.com`; roles: dns-query, tls-sni\n- domain: `oneclient.sfx.ms`; roles: dns-query, tls-sni\n- domain: `oneocsp.microsoft.com`; roles: dns-query, http-host\n- domain: `ow1.res.office365.com`; roles: dns-query, tls-sni\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query\n- domain: `quote.checkfedexexp.com`; roles: dns-query, http-host\n- domain: `r-msftstatic-com.a-0016.a-msedge.net`; roles: dns-cname\n- domain: `r.bing.com`; roles: dns-query, tls-sni\n- domain: `r.msftstatic.com`; roles: dns-query, tls-sni\n- domain: `sb.scorecardresearch.com`; roles: dns-query, tls-sni\n- domain: `settings-win.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `srtb.msn.com`; roles: dns-query, tls-sni\n- domain: `storecatalogrevocation.storequality.microsoft.com`; roles: dns-query, tls-sni\n- domain: `th.bing.com`; roles: dns-query, tls-sni\n- domain: `v10.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `v20.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `weathermapdata.blob.core.windows.net`; roles: dns-query, tls-sni\n- domain: `win-jegjix7q9rs.lafontainebleu.org`; roles: dns-query\n- domain: `windows.msn.com`; roles: dns-query, tls-sni\n- domain: `wns.notify.trafficmanager.net`; roles: dns-cname\n- domain: `wpad.lafontainebleu.org`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.msftconnecttest.com`; roles: dns-query, http-host\n- domain: `www.msn.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `10.8.15.133`; roles: network-endpoint\n- ipv4: `10.8.15.255`; roles: network-endpoint\n- ipv4: `10.8.15.4`; roles: dns-answer, network-endpoint\n- ipv4: `104.21.55.70`; roles: dns-answer, network-endpoint\n- ipv4: `104.40.82.182`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.237`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.239`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.57`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.5.93`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.158`; roles: dns-answer, network-endpoint\n- ipv4: `13.70.79.200`; roles: dns-answer, network-endpoint\n- ipv4: `13.85.23.206`; roles: dns-answer, network-endpoint\n- ipv4: `13.89.179.13`; roles: dns-answer, network-endpoint\n- ipv4: `172.67.170.159`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.115`; roles: dns-answer, network-endpoint\n- ipv4: `18.160.156.14`; roles: dns-answer\n- ipv4: `18.160.156.41`; roles: dns-answer\n- ipv4: `18.160.156.89`; roles: dns-answer\n- ipv4: `199.232.210.172`; roles: dns-answer, network-endpoint\n- ipv4: `199.232.214.172`; roles: dns-answer\n- ipv4: `20.10.31.115`; roles: dns-answer, network-endpoint\n- ipv4: `20.125.209.212`; roles: dns-answer, network-endpoint\n- ipv4: `20.163.45.186`; roles: dns-answer\n- ipv4: `20.189.173.9`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.157.9`; roles: dns-answer\n- ipv4: `20.241.44.114`; roles: dns-answer, network-endpoint\n- ipv4: `20.25.227.174`; roles: dns-answer, network-endpoint\n- ipv4: `20.3.0.251`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.65.88`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.65.94`; roles: dns-answer, network-endpoint\n- ipv4: `20.42.72.131`; roles: dns-answer, network-endpoint\n- ipv4: `20.44.10.122`; roles: dns-answer, network-endpoint\n- ipv4: `20.60.228.1`; roles: dns-answer, network-endpoint\n- ipv4: `20.96.153.111`; roles: dns-answer, network-endpoint\n- ipv4: `20.99.184.37`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.203`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.219`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.237`; roles: dns-answer\n- ipv4: `204.79.197.239`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.194.68.140`; roles: dns-answer, network-endpoint\n- ipv4: `23.195.200.230`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.12`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.48`; roles: dns-answer, network-endpoint\n- ipv4: `23.205.110.59`; roles: dns-answer\n- ipv4: `23.205.110.62`; roles: dns-answer\n- ipv4: `23.215.55.139`; roles: dns-answer, network-endpoint\n- ipv4: `23.215.55.144`; roles: dns-answer\n- ipv4: `23.220.103.18`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.103.72`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.103.78`; roles: dns-answer\n- ipv4: `23.220.103.8`; roles: dns-answer, network-endpoint\n- ipv4: `23.220.251.196`; roles: dns-answer\n- ipv4: `23.220.251.208`; roles: dns-answer, network-endpoint\n- ipv4: `23.221.36.164`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.31.29`; roles: dns-answer\n- ipv4: `23.223.31.31`; roles: dns-answer\n- ipv4: `23.223.31.32`; roles: dns-answer\n- ipv4: `23.223.31.33`; roles: dns-answer\n- ipv4: `23.223.31.34`; roles: dns-answer, network-endpoint\n- ipv4: `23.223.31.36`; roles: dns-answer\n- ipv4: `23.223.31.37`; roles: dns-answer\n- ipv4: `23.223.31.39`; roles: dns-answer\n- ipv4: `23.223.31.40`; roles: dns-answer\n- ipv4: `23.33.138.184`; roles: dns-answer, network-endpoint\n- ipv4: `23.43.244.167`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.196`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.197`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.198`; roles: dns-answer\n- ipv4: `23.53.13.199`; roles: dns-answer\n- ipv4: `23.53.13.200`; roles: dns-answer\n- ipv4: `23.53.13.202`; roles: dns-answer\n- ipv4: `23.53.13.203`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.204`; roles: dns-answer\n- ipv4: `23.53.13.205`; roles: dns-answer, network-endpoint\n- ipv4: `23.53.13.206`; roles: dns-answer\n- ipv4: `23.53.13.207`; roles: dns-answer\n- ipv4: `23.53.13.208`; roles: dns-answer\n- ipv4: `23.56.233.15`; roles: dns-answer, network-endpoint\n- ipv4: `23.60.57.94`; roles: dns-answer, network-endpoint\n- ipv4: `23.63.205.134`; roles: dns-answer, network-endpoint\n- ipv4: `23.96.180.189`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.126.29.10`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.11`; roles: dns-answer\n- ipv4: `40.126.29.12`; roles: dns-answer\n- ipv4: `40.126.29.13`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.15`; roles: dns-answer\n- ipv4: `40.126.29.5`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.29.6`; roles: dns-answer\n- ipv4: `40.126.29.7`; roles: dns-answer\n- ipv4: `40.126.29.8`; roles: dns-answer\n- ipv4: `40.126.29.9`; roles: dns-answer\n- ipv4: `51.116.253.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.136`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.0.142`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.20.38`; roles: dns-answer, network-endpoint\n- ipv4: `52.113.194.132`; roles: dns-answer, network-endpoint\n- ipv4: `52.123.128.254`; roles: dns-answer, network-endpoint\n- ipv4: `52.123.129.254`; roles: dns-answer\n- ipv4: `52.137.106.217`; roles: dns-answer, network-endpoint\n- ipv4: `52.152.180.153`; roles: dns-answer, network-endpoint\n- ipv4: `52.168.117.170`; roles: dns-answer, network-endpoint\n- ipv4: `52.182.143.215`; roles: dns-answer, network-endpoint\n- ipv4: `72.5.43.29`; roles: http-host, network-endpoint\n- ja3: `08c552d3bb717cfa625b1c2e6293fbc3`; roles: tls-client-fingerprint\n- ja3: `091f51a7a1c3a4504a224cc081ce9cee`; roles: tls-client-fingerprint\n- ja3: `09218b185cadc5bc9ac32dd4af1d80ba`; roles: tls-client-fingerprint\n- ja3: `0940eef199c4e4a2d7fff1702ca8e267`; roles: tls-client-fingerprint\n- ja3: `09d2a38ae19e8be7fa018ad87e43b2ff`; roles: tls-client-fingerprint\n- ja3: `11156bf1dc969c54ae91bbfe52874a88`; roles: tls-client-fingerprint\n- ja3: `11702f6f4b7b9c9b2999ebcf2c354984`; roles: tls-client-fingerprint\n- ja3: `173448d57b47fba3f0be89e6bd4599af`; roles: tls-client-fingerprint\n- ja3: `218b9f26907447fdbf2c8a52418444b7`; roles: tls-client-fingerprint\n- ja3: `22833c8ba3c4d8d22ef4b3ff2fdd992e`; roles: tls-client-fingerprint\n- ja3: `258a5a1e95b8a911872bae9081526644`; roles: tls-client-fingerprint\n- ja3: `25e0b3677a2832677e0c136c73a02311`; roles: tls-client-fingerprint\n- ja3: `26abc27bb714c3e30049154ed7f03422`; roles: tls-client-fingerprint\n- ja3: `2f7a1c53b0a1abfffcdeff101f69baf4`; roles: tls-client-fingerprint\n- ja3: `33717d60eef91a9c824c343c9b904387`; roles: tls-client-fingerprint\n- ja3: `34f7d1c3fe8b7bb4b8cee1ceefa986a5`; roles: tls-client-fingerprint\n- ja3: `38ff17125ac547fdaf43cbc78d13056e`; roles: tls-client-fingerprint\n- ja3: `3c293bdf2a25c07559b560ba86debc77`; roles: tls-client-fingerprint\n- ja3: `3c4eb72b882d4d1442c67ce73f1292a9`; roles: tls-client-fingerprint\n- ja3: `3ec074ef84f1118c439e56727227cea3`; roles: tls-client-fingerprint\n- ja3: `46a78af27de56cd4c85b04f57deb3f79`; roles: tls-client-fingerprint\n- ja3: `46f5131e766d248db0248a86c494b71c`; roles: tls-client-fingerprint\n- ja3: `48ae6b908317f4f14e23cfd06798d78a`; roles: tls-client-fingerprint\n- ja3: `49122e3f86717743d247b0e57255881e`; roles: tls-client-fingerprint\n- ja3: `49a844a20d27ed5590377789c1ff9a1c`; roles: tls-client-fingerprint\n- ja3: `4d09d5e0a7539f71bfd5ab61fc77938e`; roles: tls-client-fingerprint\n- ja3: `4e00cf4e4608830803d4914864014e8c`; roles: tls-client-fingerprint\n- ja3: `4e96df7dcbca32c279f0af5a0930aa87`; roles: tls-client-fingerprint\n- ja3: `589c33f5c966de68b38bf824fc667e6b`; roles: tls-client-fingerprint\n- ja3: `5919f6108f098e14c2f37619021ebd4d`; roles: tls-client-fingerprint\n- ja3: `5c263245de4d50106d8e0d6087b0fcc5`; roles: tls-client-fingerprint\n- ja3: `5c576ee905a82c07ad7987fce4f39cfe`; roles: tls-client-fingerprint\n- ja3: `65005c9d9ae0f0ebeaf22c210571d482`; roles: tls-client-fingerprint\n- ja3: `68b1b54a6edfe7729708738380263a3a`; roles: tls-client-fingerprint\n- ja3: `6925f81e11a98d706da3f0cd0f7bc648`; roles: tls-client-fingerprint\n- ja3: `6a5d235ee78c6aede6a61448b4e9ff1e`; roles: tls-client-fingerprint\n- ja3: `736a3b58b94abd6c394392ae94f501c3`; roles: tls-client-fingerprint\n- ja3: `775ceba0b13f74a42447a14045d31fcc`; roles: tls-client-fingerprint\n- ja3: `973e5ee0c53bfc4aaff964c70002dcc3`; roles: tls-client-fingerprint\n- ja3: `a2fa4f21077551ea651d383707835d7b`; roles: tls-client-fingerprint\n- ja3: `ab9d07f6268ed23da4f708263cc7ed49`; roles: tls-client-fingerprint\n- ja3: `af8bdb53babadf751a582d1ed25c0eda`; roles: tls-client-fingerprint\n- ja3: `b1e1912cc21fd3c163c8ddf91f56123a`; roles: tls-client-fingerprint\n- ja3: `b4162be74fb260b4576b62481ee819de`; roles: tls-client-fingerprint\n- ja3: `b74979b1b06e1413e302d2c817ca33db`; roles: tls-client-fingerprint\n- ja3: `b7e6d0a42505ebdcb4ca793e16825d04`; roles: tls-client-fingerprint\n- ja3: `c44656a187a470fa1e85dfc1707da993`; roles: tls-client-fingerprint\n- ja3: `c6e2484ca73f97e2cbb72bacc9c9916b`; roles: tls-client-fingerprint\n- ja3: `cd51c3a587eeacaf4f714e3920764550`; roles: tls-client-fingerprint\n- ja3: `d108c2f321a2af5781ed4b63b5b28472`; roles: tls-client-fingerprint\n- ja3: `e978fa4306e6fe19e2d404321d215b00`; roles: tls-client-fingerprint\n- ja3: `eb6eb038162eb12fda714a4a5860dc83`; roles: tls-client-fingerprint\n- ja3: `ec93fbad48fbc839a6e52e85c3f5af8d`; roles: tls-client-fingerprint\n- ja3: `f0a0d117d2207afbb65df9114a8c6321`; roles: tls-client-fingerprint\n- ja3: `f957ed04f16c95c78f474482505d5e89`; roles: tls-client-fingerprint\n- ja3: `fc2ac8b293f08f588c5b93dd8b87eef6`; roles: tls-client-fingerprint\n- ja3: `fe624dd6795521519b6fbbd082375f4f`; roles: tls-client-fingerprint\n- sha256: `0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2`; roles: exported-object\n- sha256: `261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594`; roles: exported-object\n- sha256: `2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6`; roles: exported-object\n- sha256: `41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b`; roles: exported-object\n- sha256: `5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4`; roles: exported-object\n- sha256: `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; roles: exported-object\n- sha256: `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; roles: exported-object\n- sha256: `6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c`; roles: exported-object\n- sha256: `798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5`; roles: exported-object\n- sha256: `8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47`; roles: exported-object\n- sha256: `9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499`; roles: exported-object\n- sha256: `b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6`; roles: exported-object\n- sha256: `be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252`; roles: exported-object\n- sha256: `c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110`; roles: exported-object\n- sha256: `dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123`; roles: exported-object\n- sha256: `f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64`; roles: exported-object\n- sha256: `f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e`; roles: exported-object\n- sha256: `f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://72.5.43.29/`; roles: http-request\n- url: `http://72.5.43.29/data/0f60a3e7baecf2748b1c8183ed37d1e4`; roles: http-request\n- url: `http://acroipm2.adobe.com/assets/Owner/arm/ProcessMAU.txt`; roles: http-request\n- url: `http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8f2381c2-652d-48a2-86f6-19cb7757f5dc?P1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d`; roles: http-request\n- url: `http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6?P1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d`; roles: http-request\n- url: `http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D`; roles: http-request\n- url: `http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215`; roles: http-request\n- url: `http://www.msftconnecttest.com/connecttest.txt`; roles: http-request\n- user_agent: `Microsoft BITS/7.8`; roles: http-client\n- user_agent: `Microsoft Edge/127.0.2651.98 Windows`; roles: http-client\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/10.0`; roles: http-client\n- user_agent: `Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0`; roles: http-client\n- exported object `managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215`; SHA-256 `798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5`; size 2767804 bytes\n  Static content: `{\"content_kind\":\"zip\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `0f60a3e7baecf2748b1c8183ed37d1e4`; SHA-256 `b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6`; size 159232 bytes\n  Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":159232,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\"}`. Not execution proof.\n- exported object `%2f(3)`; SHA-256 `261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594`; size 305148 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)`; SHA-256 `8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47`; size 108543 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)`; SHA-256 `6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c`; size 29990 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d`; SHA-256 `f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332`; size 18882 bytes\n- exported object `f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)`; SHA-256 `be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252`; size 13809 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)`; SHA-256 `9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499`; size 7930 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)`; SHA-256 `41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b`; size 4630 bytes\n- exported object `MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D`; SHA-256 `2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6`; size 1782 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)`; SHA-256 `0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2`; size 1340 bytes\n- exported object `8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d`; SHA-256 `c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110`; size 1120 bytes\n- exported object `%2f(5)`; SHA-256 `f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64`; size 732 bytes\n- exported object `%2f(1)`; SHA-256 `5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4`; size 124 bytes\n- exported object `%2f(10)`; SHA-256 `f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e`; size 94 bytes\n- exported object `%2f`; SHA-256 `dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123`; size 32 bytes\n- exported object `connecttest.txt`; SHA-256 `5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61`; size 22 bytes\n- exported object `ProcessMAU.txt`; SHA-256 `69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820`; size 4 bytes\n\n## Actor similarity leads\n\n- Orangeworm (G0071): 50% TTP overlap. This is an investigation lead, not attribution.\n- SilverTerrier (G0083): 25% TTP overlap. This is an investigation lead, not attribution.\n- RedEcho (G1042): 20% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- APT18 (G0026): 8% TTP overlap. This is an investigation lead, not attribution.\n- FIN4 (G0085): 8% TTP overlap. This is an investigation lead, not attribution.\n- Dark Caracal (G0070): 8% TTP overlap. This is an investigation lead, not attribution.\n- TA551 (G0127): 7% TTP overlap. This is an investigation lead, not attribution.\n- BITTER (G1002): 6% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `d16753b47de8ecdb023abba50189bbcdbc68cf5a1d4b318a005b594ca7c48206`; recorded 2026-09-19T12:08:57.190731+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":272,\"observable_limit\":5000,\"observables_checked\":272,\"observables_total\":272,\"prior_case_limit_reached\":false,\"prior_cases_checked\":8,\"truncated\":false}`\n\n- Catalog T1071.001: https://attack.mitre.org/techniques/T1071/001; detection strategies: [{\"attack_id\":\"DET0027\",\"name\":\"Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets\",\"stix_id\":\"x-mitre-detection-strategy--e6496b9b-2458-4616-9712-a7c0da7fd3bc\"}]\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 42 observations. This does not establish a common campaign.\n- Prior analysis `08324647-35af-4af2-8d82-4387eec03918` shares 46 observations. This does not establish a common campaign.\n- Prior analysis `616a90fa-f15e-4fcb-8d56-7b8e0eff5785` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `459e119d-191f-49e8-85ea-c78f9de41826` shares 33 observations. This does not establish a common campaign.\n- Prior analysis `7a2cfe72-f48d-4894-8a2d-8889cb3b11b2` shares 53 observations. This does not establish a common campaign.\n- Prior analysis `81373b30-6a59-49d1-89b0-bad73ed19eaa` shares 37 observations. This does not establish a common campaign.\n- Prior analysis `38851ad7-b3a0-423d-ae89-3b7be4e4b908` shares 36 observations. This does not establish a common campaign.\n- Prior analysis `bfccc426-aa9b-4007-8558-a66d37ecb90c` shares 69 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":18,\"exported_objects\":322,\"hashed_bytes\":3449794,\"hashed_objects\":322,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":18,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":18}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 5/5, observables 272/272, artifacts 18/18. Full returned inventory is in the JSON result.\n",
      "summary": "Decoded 18189 packets across 75 IP endpoints and 698 transport flows. Observed 430 DNS events, 404 HTTP requests, 174 TLS ClientHello events, and 18 exported HTTP object(s). Deterministic rules produced 8 finding(s): 1 high, 0 medium, and 7 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "observables": [
        {
          "type": "domain",
          "value": "a1834.dscg2.akamai.net",
          "confidence": 1,
          "description": "dns-cname; frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48, frame 12746 / UDP stream 117, frame 12747 / UDP stream 116"
        },
        {
          "type": "domain",
          "value": "acroipm2.adobe.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 15338 / UDP stream 135, frame 15339 / UDP stream 135, frame 15340 / UDP stream 135, frame 15341 / UDP stream 135, frame 15345 / TCP stream 300"
        },
        {
          "type": "domain",
          "value": "api.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3841 / UDP stream 63, frame 3842 / UDP stream 64, frame 3864 / UDP stream 63, frame 3884 / UDP stream 64, frame 12585 / UDP stream 110 +7 more"
        },
        {
          "type": "domain",
          "value": "app-edge.smartscreen.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 8661 / UDP stream 88, frame 8662 / UDP stream 89, frame 8682 / UDP stream 90, frame 8683 / UDP stream 91, frame 8701 / UDP stream 22 +9 more"
        },
        {
          "type": "domain",
          "value": "armmf.adobe.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 15349 / UDP stream 136, frame 15350 / UDP stream 136, frame 15354 / TCP stream 301"
        },
        {
          "type": "domain",
          "value": "assets.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1286 / UDP stream 14, frame 1293 / UDP stream 14, frame 3833 / UDP stream 61, frame 3834 / UDP stream 62, frame 3845 / UDP stream 62 +15 more"
        },
        {
          "type": "domain",
          "value": "blob.mwh03prdstf02a.store.core.windows.net",
          "confidence": 1,
          "description": "dns-cname; frame 12103 / UDP stream 99"
        },
        {
          "type": "domain",
          "value": "browser.events.data.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3803 / UDP stream 53, frame 3804 / UDP stream 54, frame 3823 / UDP stream 53, frame 3835 / UDP stream 54, frame 3855 / TCP stream 90 +5 more"
        },
        {
          "type": "domain",
          "value": "business.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3662 / UDP stream 45, frame 3663 / UDP stream 46, frame 3664 / UDP stream 45, frame 5368 / UDP stream 46, frame 3672 / TCP stream 89 +3 more"
        },
        {
          "type": "domain",
          "value": "business.checkfedexexp.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 9026 / UDP stream 38, frame 9027 / UDP stream 38, frame 9031 / TCP stream 124"
        },
        {
          "type": "domain",
          "value": "bzib.nelreports.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 8906 / UDP stream 93, frame 8907 / UDP stream 94, frame 8908 / UDP stream 94, frame 8910 / UDP stream 93, frame 8922 / TCP stream 122"
        },
        {
          "type": "domain",
          "value": "c-msn-com-nsatc.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 3838 / UDP stream 57, frame 3839 / UDP stream 58"
        },
        {
          "type": "domain",
          "value": "c-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11763 / UDP stream 99, frame 11764 / UDP stream 99, frame 11770 / TCP stream 158, frame 11774 / TCP stream 158"
        },
        {
          "type": "domain",
          "value": "c.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3826 / UDP stream 59, frame 3827 / UDP stream 60, frame 3836 / UDP stream 59, frame 3850 / UDP stream 60, frame 3868 / TCP stream 92 +1 more"
        },
        {
          "type": "domain",
          "value": "c.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3824 / UDP stream 57, frame 3825 / UDP stream 58, frame 3838 / UDP stream 57, frame 3839 / UDP stream 58, frame 3905 / TCP stream 93"
        },
        {
          "type": "domain",
          "value": "client.wns.windows.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1238 / UDP stream 14, frame 1241 / UDP stream 14, frame 1252 / TCP stream 58, frame 8850 / TCP stream 119"
        },
        {
          "type": "domain",
          "value": "cxcs.microsoft.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11900 / UDP stream 99, frame 11902 / UDP stream 99, frame 11908 / TCP stream 162"
        },
        {
          "type": "domain",
          "value": "default.exp-tas.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3541 / UDP stream 38, frame 3542 / UDP stream 38, frame 3546 / TCP stream 86, frame 3549 / TCP stream 86"
        },
        {
          "type": "domain",
          "value": "displaycatalog.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 13848 / UDP stream 100, frame 13849 / UDP stream 100, frame 13850 / UDP stream 100, frame 13854 / TCP stream 221"
        },
        {
          "type": "domain",
          "value": "dl-edge.smartscreen.microsoft.com",
          "confidence": 1,
          "description": "dns-query; frame 6474 / UDP stream 86, frame 6475 / UDP stream 87, frame 6476 / UDP stream 86, frame 6477 / UDP stream 87"
        },
        {
          "type": "domain",
          "value": "dual-s-ring.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11691 / UDP stream 99, frame 11696 / UDP stream 99, frame 11700 / TCP stream 156, frame 11704 / TCP stream 156"
        },
        {
          "type": "domain",
          "value": "ecn-us.dev.virtualearth.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 5420 / UDP stream 75, frame 5421 / UDP stream 76, frame 5423 / UDP stream 76, frame 5450 / UDP stream 75, frame 5509 / TCP stream 105"
        },
        {
          "type": "domain",
          "value": "ecs.office.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2997 / UDP stream 14, frame 3001 / UDP stream 14, frame 14634 / UDP stream 131, frame 14636 / UDP stream 131, frame 15758 / UDP stream 136 +15 more"
        },
        {
          "type": "domain",
          "value": "edge-consumer-static.azureedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4395 / UDP stream 68, frame 4396 / UDP stream 69, frame 4404 / UDP stream 68, frame 4413 / UDP stream 69, frame 4414 / UDP stream 69 +2 more"
        },
        {
          "type": "domain",
          "value": "edge-microsoft-com.dual-a-0036.a-msedge.net",
          "confidence": 1,
          "description": "dns-cname; frame 2109 / UDP stream 25"
        },
        {
          "type": "domain",
          "value": "edge.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2107 / UDP stream 24, frame 2108 / UDP stream 25, frame 2109 / UDP stream 25, frame 2115 / UDP stream 24, frame 2280 / UDP stream 28 +15 more"
        },
        {
          "type": "domain",
          "value": "edgeservices.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2314 / UDP stream 30, frame 2315 / UDP stream 31, frame 2316 / UDP stream 30, frame 2317 / UDP stream 31, frame 2329 / UDP stream 32 +11 more"
        },
        {
          "type": "domain",
          "value": "fd.api.iris.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1239 / UDP stream 22, frame 1242 / UDP stream 22, frame 11684 / UDP stream 38, frame 11690 / UDP stream 38, frame 11776 / UDP stream 38 +8 more"
        },
        {
          "type": "domain",
          "value": "fe2cr.update.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 14766 / UDP stream 131, frame 14767 / UDP stream 131, frame 14771 / TCP stream 269"
        },
        {
          "type": "domain",
          "value": "fe2cr.update.msft.com.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 14767 / UDP stream 131"
        },
        {
          "type": "domain",
          "value": "fe3cr.delivery.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 13888 / UDP stream 126, frame 13889 / UDP stream 126, frame 13892 / UDP stream 126, frame 13898 / TCP stream 224"
        },
        {
          "type": "domain",
          "value": "fp.msedge.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11801 / UDP stream 99, frame 11802 / UDP stream 99, frame 11806 / TCP stream 159, frame 11810 / TCP stream 159"
        },
        {
          "type": "domain",
          "value": "g.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2996 / UDP stream 22, frame 2999 / UDP stream 22, frame 14497 / UDP stream 128, frame 14498 / UDP stream 128, frame 14499 / UDP stream 128 +2 more"
        },
        {
          "type": "domain",
          "value": "go.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 72 / UDP stream 9, frame 73 / UDP stream 9, frame 77 / TCP stream 3, frame 107 / TCP stream 4, frame 1198 / TCP stream 55 +8 more"
        },
        {
          "type": "domain",
          "value": "img-s-msn-com.akamaized.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3797 / UDP stream 47, frame 3798 / UDP stream 48, frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48 +6 more"
        },
        {
          "type": "domain",
          "value": "img.s-msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 12769 / UDP stream 119, frame 12770 / UDP stream 120, frame 12808 / UDP stream 119, frame 12878 / UDP stream 120, frame 12880 / UDP stream 120 +1 more"
        },
        {
          "type": "domain",
          "value": "licensing.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 15105 / UDP stream 133, frame 15106 / UDP stream 133, frame 15107 / UDP stream 133, frame 15111 / TCP stream 287"
        },
        {
          "type": "domain",
          "value": "login.microsoftonline.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 2244 / UDP stream 14, frame 2245 / UDP stream 14, frame 10379 / UDP stream 38, frame 10380 / UDP stream 38, frame 13820 / UDP stream 100 +11 more"
        },
        {
          "type": "domain",
          "value": "mobile.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 727 / UDP stream 14, frame 728 / UDP stream 14, frame 842 / UDP stream 14, frame 843 / UDP stream 14, frame 17805 / UDP stream 151 +9 more"
        },
        {
          "type": "domain",
          "value": "mrodevicemgr.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 12259 / UDP stream 99, frame 12260 / UDP stream 99, frame 12261 / UDP stream 99, frame 12265 / TCP stream 185"
        },
        {
          "type": "domain",
          "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 10193 / UDP stream 38, frame 10194 / UDP stream 38, frame 10281 / UDP stream 38, frame 10283 / UDP stream 38, frame 10198 / TCP stream 127 +9 more"
        },
        {
          "type": "domain",
          "value": "nav-edge.smartscreen.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 6371 / UDP stream 84, frame 6372 / UDP stream 85, frame 6373 / UDP stream 84, frame 6374 / UDP stream 85, frame 6379 / TCP stream 111"
        },
        {
          "type": "domain",
          "value": "nav.smartscreen.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 15865 / UDP stream 139, frame 15866 / UDP stream 139, frame 15870 / TCP stream 338"
        },
        {
          "type": "domain",
          "value": "ntp.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3654 / UDP stream 42, frame 3655 / UDP stream 43, frame 3656 / UDP stream 42, frame 3657 / UDP stream 44, frame 3658 / UDP stream 44 +4 more"
        },
        {
          "type": "domain",
          "value": "odc.officeapps.live.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1491 / UDP stream 22, frame 1540 / UDP stream 22, frame 2998 / UDP stream 38, frame 3000 / UDP stream 38, frame 1585 / TCP stream 63 +1 more"
        },
        {
          "type": "domain",
          "value": "officeclient.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 513 / UDP stream 14, frame 623 / UDP stream 14, frame 1345 / UDP stream 22, frame 1348 / UDP stream 22, frame 671 / TCP stream 32 +1 more"
        },
        {
          "type": "domain",
          "value": "oneclient.sfx.ms",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3063 / UDP stream 22, frame 3065 / UDP stream 22, frame 14524 / UDP stream 130, frame 14526 / UDP stream 130, frame 14527 / UDP stream 130 +2 more"
        },
        {
          "type": "domain",
          "value": "oneocsp.microsoft.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 15879 / UDP stream 139, frame 15880 / UDP stream 139, frame 15884 / TCP stream 339"
        },
        {
          "type": "domain",
          "value": "ow1.res.office365.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 11731 / UDP stream 99, frame 11732 / UDP stream 99, frame 11736 / TCP stream 157"
        },
        {
          "type": "domain",
          "value": "prod.mrodevicemgr.live.com.akadns.net",
          "confidence": 1,
          "description": "dns-cname; frame 12261 / UDP stream 99"
        },
        {
          "type": "domain",
          "value": "pti.store.microsoft.com",
          "confidence": 1,
          "description": "dns-query; frame 13828 / UDP stream 100, frame 13833 / UDP stream 100"
        },
        {
          "type": "domain",
          "value": "quote.checkfedexexp.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 6200 / UDP stream 77, frame 6201 / UDP stream 78, frame 6202 / UDP stream 79, frame 6317 / UDP stream 81, frame 6318 / UDP stream 82 +11 more"
        },
        {
          "type": "domain",
          "value": "r-msftstatic-com.a-0016.a-msedge.net",
          "confidence": 1,
          "description": "dns-cname; frame 4772 / UDP stream 73"
        },
        {
          "type": "domain",
          "value": "r.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4684 / UDP stream 70, frame 4685 / UDP stream 71, frame 4774 / UDP stream 70, frame 4778 / UDP stream 71, frame 4855 / TCP stream 102 +1 more"
        },
        {
          "type": "domain",
          "value": "r.msftstatic.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4686 / UDP stream 72, frame 4687 / UDP stream 73, frame 4772 / UDP stream 73, frame 4773 / UDP stream 72, frame 4864 / TCP stream 101 +3 more"
        },
        {
          "type": "domain",
          "value": "sb.scorecardresearch.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 3799 / UDP stream 49, frame 3800 / UDP stream 50, frame 3815 / UDP stream 50, frame 3822 / UDP stream 49, frame 3909 / TCP stream 96"
        },
        {
          "type": "domain",
          "value": "settings-win.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 10406 / UDP stream 38, frame 10409 / UDP stream 38, frame 13884 / UDP stream 125, frame 13885 / UDP stream 125, frame 13886 / UDP stream 125 +2 more"
        },
        {
          "type": "domain",
          "value": "srtb.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 4384 / UDP stream 66, frame 4385 / UDP stream 67, frame 4386 / UDP stream 66, frame 4387 / UDP stream 67, frame 12713 / UDP stream 112 +9 more"
        },
        {
          "type": "domain",
          "value": "storecatalogrevocation.storequality.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 15160 / UDP stream 134, frame 15161 / UDP stream 134, frame 15164 / UDP stream 134, frame 15176 / UDP stream 134, frame 15177 / UDP stream 134 +1 more"
        },
        {
          "type": "domain",
          "value": "th.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1584 / UDP stream 14, frame 1592 / UDP stream 14, frame 3146 / UDP stream 39, frame 3147 / UDP stream 40, frame 3148 / UDP stream 39 +15 more"
        },
        {
          "type": "domain",
          "value": "v10.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 10904 / UDP stream 38, frame 10905 / UDP stream 38, frame 14085 / UDP stream 127, frame 14086 / UDP stream 127, frame 14088 / UDP stream 127 +15 more"
        },
        {
          "type": "domain",
          "value": "v20.events.data.microsoft.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1192 / UDP stream 14, frame 1194 / UDP stream 14, frame 10937 / UDP stream 38, frame 10939 / UDP stream 38, frame 1217 / TCP stream 56 +1 more"
        },
        {
          "type": "domain",
          "value": "weathermapdata.blob.core.windows.net",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 12102 / UDP stream 99, frame 12103 / UDP stream 99, frame 12107 / TCP stream 175, frame 12111 / TCP stream 175"
        },
        {
          "type": "domain",
          "value": "win-jegjix7q9rs.lafontainebleu.org",
          "confidence": 1,
          "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4, frame 472 / UDP stream 14, frame 473 / UDP stream 14"
        },
        {
          "type": "domain",
          "value": "windows.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1484 / UDP stream 14, frame 1485 / UDP stream 14, frame 12411 / UDP stream 100, frame 12416 / UDP stream 104, frame 12417 / UDP stream 105 +12 more"
        },
        {
          "type": "domain",
          "value": "wns.notify.trafficmanager.net",
          "confidence": 1,
          "description": "dns-cname; frame 1241 / UDP stream 14"
        },
        {
          "type": "domain",
          "value": "wpad.lafontainebleu.org",
          "confidence": 1,
          "description": "dns-query; frame 55 / UDP stream 9, frame 56 / UDP stream 9, frame 59 / UDP stream 10, frame 60 / UDP stream 10, frame 961 / UDP stream 14 +15 more"
        },
        {
          "type": "domain",
          "value": "www.bing.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1158 / UDP stream 14, frame 1160 / UDP stream 14, frame 2110 / UDP stream 26, frame 2111 / UDP stream 27, frame 2112 / UDP stream 26 +15 more"
        },
        {
          "type": "domain",
          "value": "www.msftconnecttest.com",
          "confidence": 1,
          "description": "dns-query, http-host; frame 61 / UDP stream 10, frame 62 / UDP stream 10, frame 66 / TCP stream 2"
        },
        {
          "type": "domain",
          "value": "www.msn.com",
          "confidence": 1,
          "description": "dns-query, tls-sni; frame 1589 / UDP stream 22, frame 1590 / UDP stream 22, frame 12534 / UDP stream 106, frame 12535 / UDP stream 107, frame 12536 / UDP stream 106 +5 more"
        },
        {
          "type": "ipv4",
          "value": "0.0.0.0",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.8.15.133",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.8.15.255",
          "confidence": 1,
          "description": "network-endpoint; no frame reference"
        },
        {
          "type": "ipv4",
          "value": "10.8.15.4",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 21 / UDP stream 4, frame 23 / UDP stream 4, frame 33 / UDP stream 4, frame 111 / UDP stream 9, frame 115 / UDP stream 9 +8 more"
        },
        {
          "type": "ipv4",
          "value": "104.21.55.70",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 6404 / UDP stream 79, frame 6405 / UDP stream 81, frame 6406 / UDP stream 83, frame 6407 / UDP stream 22, frame 6408 / UDP stream 77 +2 more"
        },
        {
          "type": "ipv4",
          "value": "104.40.82.182",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 8719 / UDP stream 22"
        },
        {
          "type": "ipv4",
          "value": "13.107.21.237",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3836 / UDP stream 59"
        },
        {
          "type": "ipv4",
          "value": "13.107.21.239",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2115 / UDP stream 24, frame 2282 / UDP stream 28, frame 10245 / UDP stream 96, frame 12210 / UDP stream 102"
        },
        {
          "type": "ipv4",
          "value": "13.107.246.57",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 4404 / UDP stream 68"
        },
        {
          "type": "ipv4",
          "value": "13.107.4.254",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 11764 / UDP stream 99"
        },
        {
          "type": "ipv4",
          "value": "13.107.5.93",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3542 / UDP stream 38"
        },
        {
          "type": "ipv4",
          "value": "13.107.6.158",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3664 / UDP stream 45"
        },
        {
          "type": "ipv4",
          "value": "13.70.79.200",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 17806 / UDP stream 151"
        },
        {
          "type": "ipv4",
          "value": "13.85.23.206",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 13892 / UDP stream 126"
        },
        {
          "type": "ipv4",
          "value": "13.89.179.13",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 728 / UDP stream 14, frame 843 / UDP stream 14"
        },
        {
          "type": "ipv4",
          "value": "172.67.170.159",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 6404 / UDP stream 79, frame 6405 / UDP stream 81, frame 6406 / UDP stream 83, frame 6407 / UDP stream 22, frame 6408 / UDP stream 77 +2 more"
        },
        {
          "type": "ipv4",
          "value": "18.160.156.115",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3822 / UDP stream 49"
        },
        {
          "type": "ipv4",
          "value": "18.160.156.14",
          "confidence": 1,
          "description": "dns-answer; frame 3822 / UDP stream 49"
        },
        {
          "type": "ipv4",
          "value": "18.160.156.41",
          "confidence": 1,
          "description": "dns-answer; frame 3822 / UDP stream 49"
        },
        {
          "type": "ipv4",
          "value": "18.160.156.89",
          "confidence": 1,
          "description": "dns-answer; frame 3822 / UDP stream 49"
        },
        {
          "type": "ipv4",
          "value": "199.232.210.172",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38"
        },
        {
          "type": "ipv4",
          "value": "199.232.214.172",
          "confidence": 1,
          "description": "dns-answer; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38"
        },
        {
          "type": "ipv4",
          "value": "20.10.31.115",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 1241 / UDP stream 14"
        },
        {
          "type": "ipv4",
          "value": "20.125.209.212",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 3838 / UDP stream 57"
        },
        {
          "type": "ipv4",
          "value": "20.163.45.186",
          "confidence": 1,
          "description": "dns-answer; frame 14767 / UDP stream 131"
        },
        {
          "type": "ipv4",
          "value": "20.189.173.9",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 16792 / UDP stream 145"
        },
        {
          "type": "ipv4",
          "value": "20.190.157.9",
          "confidence": 1,
          "description": "dns-answer; frame 2245 / UDP stream 14, frame 10380 / UDP stream 38, frame 13826 / UDP stream 100"
        },
        {
          "type": "ipv4",
          "value": "20.241.44.114",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 2999 / UDP stream 22, frame 14499 / UDP stream 128"
        },
        {
          "type": "ipv4",
          "value": "20.25.227.174",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 6373 / UDP stream 84, frame 6476 / UDP stream 86, frame 15866 / UDP stream 139"
        },
        {
          "type": "ipv4",
          "value": "20.3.0.251",
          "confidence": 1,
          "description": "dns-answer, network-endpoint; frame 15107 / UDP stream 133"
        }
      ],
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap"
      ],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "observable_count": 272,
      "evidence_copy_scope": "bounded-preview-full-evidence-retained-in-source-analysis",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "suspicious_findings": [
        {
          "reason": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior. Rule periodic-http-callbacks@pcap-rules-v3; confidence 88%.",
          "category": "Periodic HTTP callback pattern",
          "evidence": "frame 11028 / TCP stream 142, frame 11505 / TCP stream 145, frame 11619 / TCP stream 151, frame 11688 / TCP stream 155, frame 11962 / TCP stream 164 +95 more",
          "severity": "high"
        },
        {
          "reason": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm. Rule repeated-nxdomain@pcap-rules-v3; confidence 50%.",
          "category": "Repeated unsuccessful DNS resolution",
          "evidence": "frame 56 / UDP stream 9, frame 60 / UDP stream 10, frame 962 / UDP stream 14, frame 964 / UDP stream 20, frame 2106 / UDP stream 22 +15 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 281 / TCP stream 11, frame 285 / TCP stream 11, frame 292 / TCP stream 11, frame 297 / TCP stream 11, frame 312 / TCP stream 11 +64 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 37 / TCP stream 0, frame 288 / TCP stream 19, frame 295 / TCP stream 19, frame 300 / TCP stream 19, frame 304 / TCP stream 19 +95 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1096 / TCP stream 1, frame 1098 / TCP stream 1, frame 1100 / TCP stream 1, frame 1102 / TCP stream 1, frame 1104 / TCP stream 1 +10 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 282 / TCP stream 11, frame 287 / TCP stream 11, frame 293 / TCP stream 11, frame 298 / TCP stream 11, frame 313 / TCP stream 11 +64 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 39 / TCP stream 0, frame 290 / TCP stream 19, frame 299 / TCP stream 19, frame 302 / TCP stream 19, frame 305 / TCP stream 19 +95 more",
          "severity": "low"
        },
        {
          "reason": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync. Rule directory-service-activity@pcap-rules-v3; confidence 95%.",
          "category": "Directory-service protocol activity",
          "evidence": "frame 1097 / TCP stream 1, frame 1099 / TCP stream 1, frame 1101 / TCP stream 1, frame 1103 / TCP stream 1, frame 1105 / TCP stream 1 +10 more",
          "severity": "low"
        }
      ],
      "observables_truncated": true,
      "actor_similarity_leads": [
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Orangeworm",
          "similarity": 0.5,
          "shared_count": 1,
          "group_attack_id": "G0071",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "SilverTerrier",
          "similarity": 0.25,
          "shared_count": 1,
          "group_attack_id": "G0083",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "RedEcho",
          "similarity": 0.2,
          "shared_count": 1,
          "group_attack_id": "G1042",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Metador",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G1013",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Rancor",
          "similarity": 0.1111,
          "shared_count": 1,
          "group_attack_id": "G0075",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "APT18",
          "similarity": 0.0833,
          "shared_count": 1,
          "group_attack_id": "G0026",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "FIN4",
          "similarity": 0.0833,
          "shared_count": 1,
          "group_attack_id": "G0085",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "Dark Caracal",
          "similarity": 0.0833,
          "shared_count": 1,
          "group_attack_id": "G0070",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "TA551",
          "similarity": 0.0714,
          "shared_count": 1,
          "group_attack_id": "G0127",
          "shared_techniques": [
            "T1071.001"
          ]
        },
        {
          "status": "ttp-overlap-not-attribution",
          "group_name": "BITTER",
          "similarity": 0.0625,
          "shared_count": 1,
          "group_attack_id": "G1002",
          "shared_techniques": [
            "T1071.001"
          ]
        }
      ],
      "expected_suspicious_behaviors": []
    },
    {
      "id": "ttp-evidence:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:T1071.001",
      "type": "ttp-evidence",
      "label": "T1071.001 Application Layer Protocol: Web Protocols",
      "source": "log-pcap-analysis",
      "status": "suggested",
      "tactic": "command-and-control",
      "evidence": "T1071.001 Application Layer Protocol: Web Protocols",
      "attack_id": "T1071.001",
      "confidence": 0.85,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:a1834.dscg2.akamai.net",
      "type": "ioc",
      "value": "a1834.dscg2.akamai.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48, frame 12746 / UDP stream 117, frame 12747 / UDP stream 116",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:acroipm2.adobe.com",
      "type": "ioc",
      "value": "acroipm2.adobe.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, http-host; frame 15338 / UDP stream 135, frame 15339 / UDP stream 135, frame 15340 / UDP stream 135, frame 15341 / UDP stream 135, frame 15345 / TCP stream 300",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:api.msn.com",
      "type": "ioc",
      "value": "api.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3841 / UDP stream 63, frame 3842 / UDP stream 64, frame 3864 / UDP stream 63, frame 3884 / UDP stream 64, frame 12585 / UDP stream 110 +7 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:app-edge.smartscreen.microsoft.com",
      "type": "ioc",
      "value": "app-edge.smartscreen.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 8661 / UDP stream 88, frame 8662 / UDP stream 89, frame 8682 / UDP stream 90, frame 8683 / UDP stream 91, frame 8701 / UDP stream 22 +9 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:armmf.adobe.com",
      "type": "ioc",
      "value": "armmf.adobe.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 15349 / UDP stream 136, frame 15350 / UDP stream 136, frame 15354 / TCP stream 301",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:assets.msn.com",
      "type": "ioc",
      "value": "assets.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1286 / UDP stream 14, frame 1293 / UDP stream 14, frame 3833 / UDP stream 61, frame 3834 / UDP stream 62, frame 3845 / UDP stream 62 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:blob.mwh03prdstf02a.store.core.windows.net",
      "type": "ioc",
      "value": "blob.mwh03prdstf02a.store.core.windows.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 12103 / UDP stream 99",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:browser.events.data.msn.com",
      "type": "ioc",
      "value": "browser.events.data.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3803 / UDP stream 53, frame 3804 / UDP stream 54, frame 3823 / UDP stream 53, frame 3835 / UDP stream 54, frame 3855 / TCP stream 90 +5 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:business.bing.com",
      "type": "ioc",
      "value": "business.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3662 / UDP stream 45, frame 3663 / UDP stream 46, frame 3664 / UDP stream 45, frame 5368 / UDP stream 46, frame 3672 / TCP stream 89 +3 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:business.checkfedexexp.com",
      "type": "ioc",
      "value": "business.checkfedexexp.com",
      "source": "ioc-investigation",
      "verdict": "suspicious",
      "ioc_type": "domain",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "business.checkfedexexp.com was classified as domain. Investigation verdict is suspicious with score 53/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation"
      ],
      "suspicion_score": 53
    },
    {
      "id": "ioc:bzib.nelreports.net",
      "type": "ioc",
      "value": "bzib.nelreports.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 8906 / UDP stream 93, frame 8907 / UDP stream 94, frame 8908 / UDP stream 94, frame 8910 / UDP stream 93, frame 8922 / TCP stream 122",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:c-msn-com-nsatc.trafficmanager.net",
      "type": "ioc",
      "value": "c-msn-com-nsatc.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 3838 / UDP stream 57, frame 3839 / UDP stream 58",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:c-ring.msedge.net",
      "type": "ioc",
      "value": "c-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 11763 / UDP stream 99, frame 11764 / UDP stream 99, frame 11770 / TCP stream 158, frame 11774 / TCP stream 158",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:c.bing.com",
      "type": "ioc",
      "value": "c.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3826 / UDP stream 59, frame 3827 / UDP stream 60, frame 3836 / UDP stream 59, frame 3850 / UDP stream 60, frame 3868 / TCP stream 92 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:c.msn.com",
      "type": "ioc",
      "value": "c.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3824 / UDP stream 57, frame 3825 / UDP stream 58, frame 3838 / UDP stream 57, frame 3839 / UDP stream 58, frame 3905 / TCP stream 93",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:client.wns.windows.com",
      "type": "ioc",
      "value": "client.wns.windows.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1238 / UDP stream 14, frame 1241 / UDP stream 14, frame 1252 / TCP stream 58, frame 8850 / TCP stream 119",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:cxcs.microsoft.net",
      "type": "ioc",
      "value": "cxcs.microsoft.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 11900 / UDP stream 99, frame 11902 / UDP stream 99, frame 11908 / TCP stream 162",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:default.exp-tas.com",
      "type": "ioc",
      "value": "default.exp-tas.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3541 / UDP stream 38, frame 3542 / UDP stream 38, frame 3546 / TCP stream 86, frame 3549 / TCP stream 86",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:displaycatalog.mp.microsoft.com",
      "type": "ioc",
      "value": "displaycatalog.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 13848 / UDP stream 100, frame 13849 / UDP stream 100, frame 13850 / UDP stream 100, frame 13854 / TCP stream 221",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dl-edge.smartscreen.microsoft.com",
      "type": "ioc",
      "value": "dl-edge.smartscreen.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query; frame 6474 / UDP stream 86, frame 6475 / UDP stream 87, frame 6476 / UDP stream 86, frame 6477 / UDP stream 87",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:dual-s-ring.msedge.net",
      "type": "ioc",
      "value": "dual-s-ring.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 11691 / UDP stream 99, frame 11696 / UDP stream 99, frame 11700 / TCP stream 156, frame 11704 / TCP stream 156",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ecn-us.dev.virtualearth.net",
      "type": "ioc",
      "value": "ecn-us.dev.virtualearth.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 5420 / UDP stream 75, frame 5421 / UDP stream 76, frame 5423 / UDP stream 76, frame 5450 / UDP stream 75, frame 5509 / TCP stream 105",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ecs.office.com",
      "type": "ioc",
      "value": "ecs.office.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 2997 / UDP stream 14, frame 3001 / UDP stream 14, frame 14634 / UDP stream 131, frame 14636 / UDP stream 131, frame 15758 / UDP stream 136 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:edge-consumer-static.azureedge.net",
      "type": "ioc",
      "value": "edge-consumer-static.azureedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 4395 / UDP stream 68, frame 4396 / UDP stream 69, frame 4404 / UDP stream 68, frame 4413 / UDP stream 69, frame 4414 / UDP stream 69 +2 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:edge-microsoft-com.dual-a-0036.a-msedge.net",
      "type": "ioc",
      "value": "edge-microsoft-com.dual-a-0036.a-msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 2109 / UDP stream 25",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:edge.microsoft.com",
      "type": "ioc",
      "value": "edge.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 2107 / UDP stream 24, frame 2108 / UDP stream 25, frame 2109 / UDP stream 25, frame 2115 / UDP stream 24, frame 2280 / UDP stream 28 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:edgeservices.bing.com",
      "type": "ioc",
      "value": "edgeservices.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 2314 / UDP stream 30, frame 2315 / UDP stream 31, frame 2316 / UDP stream 30, frame 2317 / UDP stream 31, frame 2329 / UDP stream 32 +11 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fd.api.iris.microsoft.com",
      "type": "ioc",
      "value": "fd.api.iris.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1239 / UDP stream 22, frame 1242 / UDP stream 22, frame 11684 / UDP stream 38, frame 11690 / UDP stream 38, frame 11776 / UDP stream 38 +8 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe2cr.update.microsoft.com",
      "type": "ioc",
      "value": "fe2cr.update.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 14766 / UDP stream 131, frame 14767 / UDP stream 131, frame 14771 / TCP stream 269",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe2cr.update.msft.com.trafficmanager.net",
      "type": "ioc",
      "value": "fe2cr.update.msft.com.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 14767 / UDP stream 131",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fe3cr.delivery.mp.microsoft.com",
      "type": "ioc",
      "value": "fe3cr.delivery.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 13888 / UDP stream 126, frame 13889 / UDP stream 126, frame 13892 / UDP stream 126, frame 13898 / TCP stream 224",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:fp.msedge.net",
      "type": "ioc",
      "value": "fp.msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 11801 / UDP stream 99, frame 11802 / UDP stream 99, frame 11806 / TCP stream 159, frame 11810 / TCP stream 159",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:g.live.com",
      "type": "ioc",
      "value": "g.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 2996 / UDP stream 22, frame 2999 / UDP stream 22, frame 14497 / UDP stream 128, frame 14498 / UDP stream 128, frame 14499 / UDP stream 128 +2 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:go.microsoft.com",
      "type": "ioc",
      "value": "go.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 72 / UDP stream 9, frame 73 / UDP stream 9, frame 77 / TCP stream 3, frame 107 / TCP stream 4, frame 1198 / TCP stream 55 +8 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:img-s-msn-com.akamaized.net",
      "type": "ioc",
      "value": "img-s-msn-com.akamaized.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3797 / UDP stream 47, frame 3798 / UDP stream 48, frame 3816 / UDP stream 47, frame 3828 / UDP stream 48, frame 3829 / UDP stream 48 +6 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:img.s-msn.com",
      "type": "ioc",
      "value": "img.s-msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 12769 / UDP stream 119, frame 12770 / UDP stream 120, frame 12808 / UDP stream 119, frame 12878 / UDP stream 120, frame 12880 / UDP stream 120 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:licensing.mp.microsoft.com",
      "type": "ioc",
      "value": "licensing.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 15105 / UDP stream 133, frame 15106 / UDP stream 133, frame 15107 / UDP stream 133, frame 15111 / TCP stream 287",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:login.microsoftonline.com",
      "type": "ioc",
      "value": "login.microsoftonline.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 2244 / UDP stream 14, frame 2245 / UDP stream 14, frame 10379 / UDP stream 38, frame 10380 / UDP stream 38, frame 13820 / UDP stream 100 +11 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mobile.events.data.microsoft.com",
      "type": "ioc",
      "value": "mobile.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 727 / UDP stream 14, frame 728 / UDP stream 14, frame 842 / UDP stream 14, frame 843 / UDP stream 14, frame 17805 / UDP stream 151 +9 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:mrodevicemgr.officeapps.live.com",
      "type": "ioc",
      "value": "mrodevicemgr.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 12259 / UDP stream 99, frame 12260 / UDP stream 99, frame 12261 / UDP stream 99, frame 12265 / TCP stream 185",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:msedge.b.tlu.dl.delivery.mp.microsoft.com",
      "type": "ioc",
      "value": "msedge.b.tlu.dl.delivery.mp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, http-host; frame 10193 / UDP stream 38, frame 10194 / UDP stream 38, frame 10281 / UDP stream 38, frame 10283 / UDP stream 38, frame 10198 / TCP stream 127 +9 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nav-edge.smartscreen.microsoft.com",
      "type": "ioc",
      "value": "nav-edge.smartscreen.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 6371 / UDP stream 84, frame 6372 / UDP stream 85, frame 6373 / UDP stream 84, frame 6374 / UDP stream 85, frame 6379 / TCP stream 111",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:nav.smartscreen.microsoft.com",
      "type": "ioc",
      "value": "nav.smartscreen.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 15865 / UDP stream 139, frame 15866 / UDP stream 139, frame 15870 / TCP stream 338",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ntp.msn.com",
      "type": "ioc",
      "value": "ntp.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3654 / UDP stream 42, frame 3655 / UDP stream 43, frame 3656 / UDP stream 42, frame 3657 / UDP stream 44, frame 3658 / UDP stream 44 +4 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:odc.officeapps.live.com",
      "type": "ioc",
      "value": "odc.officeapps.live.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1491 / UDP stream 22, frame 1540 / UDP stream 22, frame 2998 / UDP stream 38, frame 3000 / UDP stream 38, frame 1585 / TCP stream 63 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:officeclient.microsoft.com",
      "type": "ioc",
      "value": "officeclient.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 513 / UDP stream 14, frame 623 / UDP stream 14, frame 1345 / UDP stream 22, frame 1348 / UDP stream 22, frame 671 / TCP stream 32 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:oneclient.sfx.ms",
      "type": "ioc",
      "value": "oneclient.sfx.ms",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3063 / UDP stream 22, frame 3065 / UDP stream 22, frame 14524 / UDP stream 130, frame 14526 / UDP stream 130, frame 14527 / UDP stream 130 +2 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:oneocsp.microsoft.com",
      "type": "ioc",
      "value": "oneocsp.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, http-host; frame 15879 / UDP stream 139, frame 15880 / UDP stream 139, frame 15884 / TCP stream 339",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:ow1.res.office365.com",
      "type": "ioc",
      "value": "ow1.res.office365.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 11731 / UDP stream 99, frame 11732 / UDP stream 99, frame 11736 / TCP stream 157",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:prod.mrodevicemgr.live.com.akadns.net",
      "type": "ioc",
      "value": "prod.mrodevicemgr.live.com.akadns.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 12261 / UDP stream 99",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:pti.store.microsoft.com",
      "type": "ioc",
      "value": "pti.store.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query; frame 13828 / UDP stream 100, frame 13833 / UDP stream 100",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:quote.checkfedexexp.com",
      "type": "ioc",
      "value": "quote.checkfedexexp.com",
      "source": "ioc-investigation",
      "verdict": "needs review",
      "ioc_type": "domain",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "quote.checkfedexexp.com was classified as domain. Investigation verdict is needs review with score 39/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation"
      ],
      "suspicion_score": 39
    },
    {
      "id": "ioc:r-msftstatic-com.a-0016.a-msedge.net",
      "type": "ioc",
      "value": "r-msftstatic-com.a-0016.a-msedge.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 4772 / UDP stream 73",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:r.bing.com",
      "type": "ioc",
      "value": "r.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 4684 / UDP stream 70, frame 4685 / UDP stream 71, frame 4774 / UDP stream 70, frame 4778 / UDP stream 71, frame 4855 / TCP stream 102 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:r.msftstatic.com",
      "type": "ioc",
      "value": "r.msftstatic.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 4686 / UDP stream 72, frame 4687 / UDP stream 73, frame 4772 / UDP stream 73, frame 4773 / UDP stream 72, frame 4864 / TCP stream 101 +3 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:sb.scorecardresearch.com",
      "type": "ioc",
      "value": "sb.scorecardresearch.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 3799 / UDP stream 49, frame 3800 / UDP stream 50, frame 3815 / UDP stream 50, frame 3822 / UDP stream 49, frame 3909 / TCP stream 96",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:settings-win.data.microsoft.com",
      "type": "ioc",
      "value": "settings-win.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 10406 / UDP stream 38, frame 10409 / UDP stream 38, frame 13884 / UDP stream 125, frame 13885 / UDP stream 125, frame 13886 / UDP stream 125 +2 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:srtb.msn.com",
      "type": "ioc",
      "value": "srtb.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 4384 / UDP stream 66, frame 4385 / UDP stream 67, frame 4386 / UDP stream 66, frame 4387 / UDP stream 67, frame 12713 / UDP stream 112 +9 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:storecatalogrevocation.storequality.microsoft.com",
      "type": "ioc",
      "value": "storecatalogrevocation.storequality.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 15160 / UDP stream 134, frame 15161 / UDP stream 134, frame 15164 / UDP stream 134, frame 15176 / UDP stream 134, frame 15177 / UDP stream 134 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:th.bing.com",
      "type": "ioc",
      "value": "th.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1584 / UDP stream 14, frame 1592 / UDP stream 14, frame 3146 / UDP stream 39, frame 3147 / UDP stream 40, frame 3148 / UDP stream 39 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v10.events.data.microsoft.com",
      "type": "ioc",
      "value": "v10.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 10904 / UDP stream 38, frame 10905 / UDP stream 38, frame 14085 / UDP stream 127, frame 14086 / UDP stream 127, frame 14088 / UDP stream 127 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:v20.events.data.microsoft.com",
      "type": "ioc",
      "value": "v20.events.data.microsoft.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1192 / UDP stream 14, frame 1194 / UDP stream 14, frame 10937 / UDP stream 38, frame 10939 / UDP stream 38, frame 1217 / TCP stream 56 +1 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:weathermapdata.blob.core.windows.net",
      "type": "ioc",
      "value": "weathermapdata.blob.core.windows.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 12102 / UDP stream 99, frame 12103 / UDP stream 99, frame 12107 / TCP stream 175, frame 12111 / TCP stream 175",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:win-jegjix7q9rs.lafontainebleu.org",
      "type": "ioc",
      "value": "win-jegjix7q9rs.lafontainebleu.org",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query; frame 22 / UDP stream 4, frame 23 / UDP stream 4, frame 472 / UDP stream 14, frame 473 / UDP stream 14",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:windows.msn.com",
      "type": "ioc",
      "value": "windows.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1484 / UDP stream 14, frame 1485 / UDP stream 14, frame 12411 / UDP stream 100, frame 12416 / UDP stream 104, frame 12417 / UDP stream 105 +12 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wns.notify.trafficmanager.net",
      "type": "ioc",
      "value": "wns.notify.trafficmanager.net",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-cname; frame 1241 / UDP stream 14",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:wpad.lafontainebleu.org",
      "type": "ioc",
      "value": "wpad.lafontainebleu.org",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query; frame 55 / UDP stream 9, frame 56 / UDP stream 9, frame 59 / UDP stream 10, frame 60 / UDP stream 10, frame 961 / UDP stream 14 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.bing.com",
      "type": "ioc",
      "value": "www.bing.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1158 / UDP stream 14, frame 1160 / UDP stream 14, frame 2110 / UDP stream 26, frame 2111 / UDP stream 27, frame 2112 / UDP stream 26 +15 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.msftconnecttest.com",
      "type": "ioc",
      "value": "www.msftconnecttest.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, http-host; frame 61 / UDP stream 10, frame 62 / UDP stream 10, frame 66 / TCP stream 2",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:www.msn.com",
      "type": "ioc",
      "value": "www.msn.com",
      "source": "log-pcap-analysis",
      "ioc_type": "domain",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-query, tls-sni; frame 1589 / UDP stream 22, frame 1590 / UDP stream 22, frame 12534 / UDP stream 106, frame 12535 / UDP stream 107, frame 12536 / UDP stream 106 +5 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:0.0.0.0",
      "type": "ioc",
      "value": "0.0.0.0",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.8.15.133",
      "type": "ioc",
      "value": "10.8.15.133",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.8.15.255",
      "type": "ioc",
      "value": "10.8.15.255",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "network-endpoint; no frame reference",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:10.8.15.4",
      "type": "ioc",
      "value": "10.8.15.4",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 21 / UDP stream 4, frame 23 / UDP stream 4, frame 33 / UDP stream 4, frame 111 / UDP stream 9, frame 115 / UDP stream 9 +8 more",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:104.21.55.70",
      "type": "ioc",
      "value": "104.21.55.70",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "ip",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "104.21.55.70 was classified as ip. Investigation verdict is highly suspicious with score 100/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation"
      ],
      "suspicion_score": 100
    },
    {
      "id": "ioc:104.40.82.182",
      "type": "ioc",
      "value": "104.40.82.182",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 8719 / UDP stream 22",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.21.237",
      "type": "ioc",
      "value": "13.107.21.237",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 3836 / UDP stream 59",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.21.239",
      "type": "ioc",
      "value": "13.107.21.239",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 2115 / UDP stream 24, frame 2282 / UDP stream 28, frame 10245 / UDP stream 96, frame 12210 / UDP stream 102",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.246.57",
      "type": "ioc",
      "value": "13.107.246.57",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 4404 / UDP stream 68",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.4.254",
      "type": "ioc",
      "value": "13.107.4.254",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 11764 / UDP stream 99",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.5.93",
      "type": "ioc",
      "value": "13.107.5.93",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 3542 / UDP stream 38",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.107.6.158",
      "type": "ioc",
      "value": "13.107.6.158",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 3664 / UDP stream 45",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.70.79.200",
      "type": "ioc",
      "value": "13.70.79.200",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 17806 / UDP stream 151",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.85.23.206",
      "type": "ioc",
      "value": "13.85.23.206",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 13892 / UDP stream 126",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:13.89.179.13",
      "type": "ioc",
      "value": "13.89.179.13",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 728 / UDP stream 14, frame 843 / UDP stream 14",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:172.67.170.159",
      "type": "ioc",
      "value": "172.67.170.159",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "ip",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "172.67.170.159 was classified as ip. Investigation verdict is highly suspicious with score 100/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation"
      ],
      "suspicion_score": 100
    },
    {
      "id": "ioc:18.160.156.115",
      "type": "ioc",
      "value": "18.160.156.115",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 3822 / UDP stream 49",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:18.160.156.14",
      "type": "ioc",
      "value": "18.160.156.14",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer; frame 3822 / UDP stream 49",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:18.160.156.41",
      "type": "ioc",
      "value": "18.160.156.41",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer; frame 3822 / UDP stream 49",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:18.160.156.89",
      "type": "ioc",
      "value": "18.160.156.89",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer; frame 3822 / UDP stream 49",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:199.232.210.172",
      "type": "ioc",
      "value": "199.232.210.172",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:199.232.214.172",
      "type": "ioc",
      "value": "199.232.214.172",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer; frame 10194 / UDP stream 38, frame 10283 / UDP stream 38",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.10.31.115",
      "type": "ioc",
      "value": "20.10.31.115",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 1241 / UDP stream 14",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.125.209.212",
      "type": "ioc",
      "value": "20.125.209.212",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 3838 / UDP stream 57",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.163.45.186",
      "type": "ioc",
      "value": "20.163.45.186",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer; frame 14767 / UDP stream 131",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.189.173.9",
      "type": "ioc",
      "value": "20.189.173.9",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 16792 / UDP stream 145",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.190.157.9",
      "type": "ioc",
      "value": "20.190.157.9",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer; frame 2245 / UDP stream 14, frame 10380 / UDP stream 38, frame 13826 / UDP stream 100",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.241.44.114",
      "type": "ioc",
      "value": "20.241.44.114",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 2999 / UDP stream 22, frame 14499 / UDP stream 128",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.25.227.174",
      "type": "ioc",
      "value": "20.25.227.174",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 6373 / UDP stream 84, frame 6476 / UDP stream 86, frame 15866 / UDP stream 139",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "ioc:20.3.0.251",
      "type": "ioc",
      "value": "20.3.0.251",
      "source": "log-pcap-analysis",
      "ioc_type": "ipv4",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "description": "dns-answer, network-endpoint; frame 15107 / UDP stream 133",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "log-pcap-analysis"
      ]
    },
    {
      "id": "finding-11a7e4318835eb1c13fc1c02",
      "type": "pcap-finding",
      "label": "Periodic HTTP callback pattern",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "uri": "/",
        "host": "72.5.43.29",
        "port": 80,
        "method": "GET",
        "source": "10.8.15.133",
        "destination": "72.5.43.29",
        "request_count": 303,
        "median_interval_seconds": 5.685,
        "median_absolute_deviation": 1.037
      },
      "rule_id": "periodic-http-callbacks",
      "severity": "high",
      "confidence": 0.88,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Repeated requests have a stable cadence consistent with automated callback or beacon behavior.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 142,
          "frame_number": 11028,
          "display_filter": "frame.number == 11028",
          "timestamp_epoch": "1723680780.664378000"
        },
        {
          "tcp_stream": 145,
          "frame_number": 11505,
          "display_filter": "frame.number == 11505",
          "timestamp_epoch": "1723680787.999666000"
        },
        {
          "tcp_stream": 151,
          "frame_number": 11619,
          "display_filter": "frame.number == 11619",
          "timestamp_epoch": "1723680793.850601000"
        },
        {
          "tcp_stream": 155,
          "frame_number": 11688,
          "display_filter": "frame.number == 11688",
          "timestamp_epoch": "1723680797.315577000"
        },
        {
          "tcp_stream": 164,
          "frame_number": 11962,
          "display_filter": "frame.number == 11962",
          "timestamp_epoch": "1723680804.254102000"
        },
        {
          "tcp_stream": 165,
          "frame_number": 11974,
          "display_filter": "frame.number == 11974",
          "timestamp_epoch": "1723680809.944683000"
        },
        {
          "tcp_stream": 166,
          "frame_number": 11993,
          "display_filter": "frame.number == 11993",
          "timestamp_epoch": "1723680817.194861000"
        },
        {
          "tcp_stream": 167,
          "frame_number": 12004,
          "display_filter": "frame.number == 12004",
          "timestamp_epoch": "1723680823.591854000"
        },
        {
          "tcp_stream": 168,
          "frame_number": 12017,
          "display_filter": "frame.number == 12017",
          "timestamp_epoch": "1723680829.193045000"
        },
        {
          "tcp_stream": 169,
          "frame_number": 12032,
          "display_filter": "frame.number == 12032",
          "timestamp_epoch": "1723680835.214191000"
        },
        {
          "tcp_stream": 170,
          "frame_number": 12045,
          "display_filter": "frame.number == 12045",
          "timestamp_epoch": "1723680839.081492000"
        },
        {
          "tcp_stream": 171,
          "frame_number": 12060,
          "display_filter": "frame.number == 12060",
          "timestamp_epoch": "1723680843.782430000"
        },
        {
          "tcp_stream": 172,
          "frame_number": 12072,
          "display_filter": "frame.number == 12072",
          "timestamp_epoch": "1723680847.998603000"
        },
        {
          "tcp_stream": 173,
          "frame_number": 12087,
          "display_filter": "frame.number == 12087",
          "timestamp_epoch": "1723680852.361708000"
        },
        {
          "tcp_stream": 174,
          "frame_number": 12096,
          "display_filter": "frame.number == 12096",
          "timestamp_epoch": "1723680857.007048000"
        },
        {
          "tcp_stream": 176,
          "frame_number": 12141,
          "display_filter": "frame.number == 12141",
          "timestamp_epoch": "1723680862.196492000"
        },
        {
          "tcp_stream": 177,
          "frame_number": 12154,
          "display_filter": "frame.number == 12154",
          "timestamp_epoch": "1723680868.478805000"
        },
        {
          "tcp_stream": 178,
          "frame_number": 12164,
          "display_filter": "frame.number == 12164",
          "timestamp_epoch": "1723680872.853090000"
        },
        {
          "tcp_stream": 179,
          "frame_number": 12175,
          "display_filter": "frame.number == 12175",
          "timestamp_epoch": "1723680878.604245000"
        },
        {
          "tcp_stream": 180,
          "frame_number": 12186,
          "display_filter": "frame.number == 12186",
          "timestamp_epoch": "1723680886.067560000"
        },
        {
          "tcp_stream": 181,
          "frame_number": 12200,
          "display_filter": "frame.number == 12200",
          "timestamp_epoch": "1723680893.807805000"
        },
        {
          "tcp_stream": 183,
          "frame_number": 12242,
          "display_filter": "frame.number == 12242",
          "timestamp_epoch": "1723680900.014338000"
        },
        {
          "tcp_stream": 184,
          "frame_number": 12253,
          "display_filter": "frame.number == 12253",
          "timestamp_epoch": "1723680907.248656000"
        },
        {
          "tcp_stream": 206,
          "frame_number": 13263,
          "display_filter": "frame.number == 13263",
          "timestamp_epoch": "1723680913.542763000"
        },
        {
          "tcp_stream": 207,
          "frame_number": 13589,
          "display_filter": "frame.number == 13589",
          "timestamp_epoch": "1723680917.980065000"
        },
        {
          "tcp_stream": 208,
          "frame_number": 13609,
          "display_filter": "frame.number == 13609",
          "timestamp_epoch": "1723680923.254494000"
        },
        {
          "tcp_stream": 209,
          "frame_number": 13635,
          "display_filter": "frame.number == 13635",
          "timestamp_epoch": "1723680975.818959000"
        },
        {
          "tcp_stream": 210,
          "frame_number": 13655,
          "display_filter": "frame.number == 13655",
          "timestamp_epoch": "1723680982.660112000"
        },
        {
          "tcp_stream": 215,
          "frame_number": 13739,
          "display_filter": "frame.number == 13739",
          "timestamp_epoch": "1723680986.523941000"
        },
        {
          "tcp_stream": 222,
          "frame_number": 13911,
          "display_filter": "frame.number == 13911",
          "timestamp_epoch": "1723680990.391966000"
        },
        {
          "tcp_stream": 225,
          "frame_number": 14070,
          "display_filter": "frame.number == 14070",
          "timestamp_epoch": "1723680994.843801000"
        },
        {
          "tcp_stream": 226,
          "frame_number": 14091,
          "display_filter": "frame.number == 14091",
          "timestamp_epoch": "1723681000.674471000"
        },
        {
          "tcp_stream": 228,
          "frame_number": 14138,
          "display_filter": "frame.number == 14138",
          "timestamp_epoch": "1723681006.223359000"
        },
        {
          "tcp_stream": 230,
          "frame_number": 14178,
          "display_filter": "frame.number == 14178",
          "timestamp_epoch": "1723681013.189457000"
        },
        {
          "tcp_stream": 231,
          "frame_number": 14189,
          "display_filter": "frame.number == 14189",
          "timestamp_epoch": "1723681018.917530000"
        },
        {
          "tcp_stream": 232,
          "frame_number": 14201,
          "display_filter": "frame.number == 14201",
          "timestamp_epoch": "1723681026.263547000"
        },
        {
          "tcp_stream": 233,
          "frame_number": 14210,
          "display_filter": "frame.number == 14210",
          "timestamp_epoch": "1723681032.790381000"
        },
        {
          "tcp_stream": 234,
          "frame_number": 14221,
          "display_filter": "frame.number == 14221",
          "timestamp_epoch": "1723681037.630532000"
        },
        {
          "tcp_stream": 236,
          "frame_number": 14254,
          "display_filter": "frame.number == 14254",
          "timestamp_epoch": "1723681043.230910000"
        },
        {
          "tcp_stream": 237,
          "frame_number": 14263,
          "display_filter": "frame.number == 14263",
          "timestamp_epoch": "1723681050.323085000"
        },
        {
          "tcp_stream": 238,
          "frame_number": 14272,
          "display_filter": "frame.number == 14272",
          "timestamp_epoch": "1723681056.322087000"
        },
        {
          "tcp_stream": 239,
          "frame_number": 14281,
          "display_filter": "frame.number == 14281",
          "timestamp_epoch": "1723681060.099936000"
        },
        {
          "tcp_stream": 240,
          "frame_number": 14290,
          "display_filter": "frame.number == 14290",
          "timestamp_epoch": "1723681063.593064000"
        },
        {
          "tcp_stream": 241,
          "frame_number": 14301,
          "display_filter": "frame.number == 14301",
          "timestamp_epoch": "1723681070.563338000"
        },
        {
          "tcp_stream": 242,
          "frame_number": 14312,
          "display_filter": "frame.number == 14312",
          "timestamp_epoch": "1723681076.331728000"
        },
        {
          "tcp_stream": 243,
          "frame_number": 14324,
          "display_filter": "frame.number == 14324",
          "timestamp_epoch": "1723681083.743242000"
        },
        {
          "tcp_stream": 244,
          "frame_number": 14335,
          "display_filter": "frame.number == 14335",
          "timestamp_epoch": "1723681090.400183000"
        },
        {
          "tcp_stream": 245,
          "frame_number": 14344,
          "display_filter": "frame.number == 14344",
          "timestamp_epoch": "1723681095.477626000"
        },
        {
          "tcp_stream": 246,
          "frame_number": 14358,
          "display_filter": "frame.number == 14358",
          "timestamp_epoch": "1723681101.539859000"
        },
        {
          "tcp_stream": 247,
          "frame_number": 14373,
          "display_filter": "frame.number == 14373",
          "timestamp_epoch": "1723681105.503006000"
        },
        {
          "tcp_stream": 248,
          "frame_number": 14383,
          "display_filter": "frame.number == 14383",
          "timestamp_epoch": "1723681109.332869000"
        },
        {
          "tcp_stream": 249,
          "frame_number": 14394,
          "display_filter": "frame.number == 14394",
          "timestamp_epoch": "1723681112.883107000"
        },
        {
          "tcp_stream": 250,
          "frame_number": 14406,
          "display_filter": "frame.number == 14406",
          "timestamp_epoch": "1723681119.999894000"
        },
        {
          "tcp_stream": 251,
          "frame_number": 14415,
          "display_filter": "frame.number == 14415",
          "timestamp_epoch": "1723681126.022041000"
        },
        {
          "tcp_stream": 252,
          "frame_number": 14424,
          "display_filter": "frame.number == 14424",
          "timestamp_epoch": "1723681129.862278000"
        },
        {
          "tcp_stream": 253,
          "frame_number": 14437,
          "display_filter": "frame.number == 14437",
          "timestamp_epoch": "1723681133.454087000"
        },
        {
          "tcp_stream": 254,
          "frame_number": 14450,
          "display_filter": "frame.number == 14450",
          "timestamp_epoch": "1723681140.654390000"
        },
        {
          "tcp_stream": 255,
          "frame_number": 14459,
          "display_filter": "frame.number == 14459",
          "timestamp_epoch": "1723681146.895398000"
        },
        {
          "tcp_stream": 256,
          "frame_number": 14470,
          "display_filter": "frame.number == 14470",
          "timestamp_epoch": "1723681151.153685000"
        },
        {
          "tcp_stream": 261,
          "frame_number": 14647,
          "display_filter": "frame.number == 14647",
          "timestamp_epoch": "1723681155.562098000"
        },
        {
          "tcp_stream": 263,
          "frame_number": 14675,
          "display_filter": "frame.number == 14675",
          "timestamp_epoch": "1723681160.282703000"
        },
        {
          "tcp_stream": 264,
          "frame_number": 14698,
          "display_filter": "frame.number == 14698",
          "timestamp_epoch": "1723681165.914795000"
        },
        {
          "tcp_stream": 265,
          "frame_number": 14707,
          "display_filter": "frame.number == 14707",
          "timestamp_epoch": "1723681172.798210000"
        },
        {
          "tcp_stream": 266,
          "frame_number": 14719,
          "display_filter": "frame.number == 14719",
          "timestamp_epoch": "1723681179.882767000"
        },
        {
          "tcp_stream": 267,
          "frame_number": 14736,
          "display_filter": "frame.number == 14736",
          "timestamp_epoch": "1723681184.875518000"
        },
        {
          "tcp_stream": 268,
          "frame_number": 14760,
          "display_filter": "frame.number == 14760",
          "timestamp_epoch": "1723681190.222347000"
        },
        {
          "tcp_stream": 270,
          "frame_number": 14792,
          "display_filter": "frame.number == 14792",
          "timestamp_epoch": "1723681196.830819000"
        },
        {
          "tcp_stream": 271,
          "frame_number": 14806,
          "display_filter": "frame.number == 14806",
          "timestamp_epoch": "1723681201.842354000"
        },
        {
          "tcp_stream": 272,
          "frame_number": 14921,
          "display_filter": "frame.number == 14921",
          "timestamp_epoch": "1723681209.572065000"
        },
        {
          "tcp_stream": 274,
          "frame_number": 14962,
          "display_filter": "frame.number == 14962",
          "timestamp_epoch": "1723681215.076361000"
        },
        {
          "tcp_stream": 275,
          "frame_number": 14979,
          "display_filter": "frame.number == 14979",
          "timestamp_epoch": "1723681221.962481000"
        },
        {
          "tcp_stream": 276,
          "frame_number": 14989,
          "display_filter": "frame.number == 14989",
          "timestamp_epoch": "1723681227.561961000"
        },
        {
          "tcp_stream": 277,
          "frame_number": 14999,
          "display_filter": "frame.number == 14999",
          "timestamp_epoch": "1723681234.695176000"
        },
        {
          "tcp_stream": 278,
          "frame_number": 15010,
          "display_filter": "frame.number == 15010",
          "timestamp_epoch": "1723681240.762230000"
        },
        {
          "tcp_stream": 279,
          "frame_number": 15021,
          "display_filter": "frame.number == 15021",
          "timestamp_epoch": "1723681244.681707000"
        },
        {
          "tcp_stream": 280,
          "frame_number": 15037,
          "display_filter": "frame.number == 15037",
          "timestamp_epoch": "1723681250.455053000"
        },
        {
          "tcp_stream": 281,
          "frame_number": 15047,
          "display_filter": "frame.number == 15047",
          "timestamp_epoch": "1723681255.848643000"
        },
        {
          "tcp_stream": 282,
          "frame_number": 15060,
          "display_filter": "frame.number == 15060",
          "timestamp_epoch": "1723681262.791423000"
        },
        {
          "tcp_stream": 283,
          "frame_number": 15078,
          "display_filter": "frame.number == 15078",
          "timestamp_epoch": "1723681269.649464000"
        },
        {
          "tcp_stream": 284,
          "frame_number": 15089,
          "display_filter": "frame.number == 15089",
          "timestamp_epoch": "1723681273.870863000"
        },
        {
          "tcp_stream": 285,
          "frame_number": 15098,
          "display_filter": "frame.number == 15098",
          "timestamp_epoch": "1723681278.112448000"
        },
        {
          "tcp_stream": 286,
          "frame_number": 15122,
          "display_filter": "frame.number == 15122",
          "timestamp_epoch": "1723681282.733454000"
        },
        {
          "tcp_stream": 288,
          "frame_number": 15170,
          "display_filter": "frame.number == 15170",
          "timestamp_epoch": "1723681287.618414000"
        },
        {
          "tcp_stream": 290,
          "frame_number": 15206,
          "display_filter": "frame.number == 15206",
          "timestamp_epoch": "1723681294.874856000"
        },
        {
          "tcp_stream": 291,
          "frame_number": 15217,
          "display_filter": "frame.number == 15217",
          "timestamp_epoch": "1723681299.634243000"
        },
        {
          "tcp_stream": 294,
          "frame_number": 15250,
          "display_filter": "frame.number == 15250",
          "timestamp_epoch": "1723681305.055347000"
        },
        {
          "tcp_stream": 295,
          "frame_number": 15260,
          "display_filter": "frame.number == 15260",
          "timestamp_epoch": "1723681311.776154000"
        },
        {
          "tcp_stream": 297,
          "frame_number": 15311,
          "display_filter": "frame.number == 15311",
          "timestamp_epoch": "1723681318.536068000"
        },
        {
          "tcp_stream": 298,
          "frame_number": 15320,
          "display_filter": "frame.number == 15320",
          "timestamp_epoch": "1723681322.887261000"
        },
        {
          "tcp_stream": 299,
          "frame_number": 15332,
          "display_filter": "frame.number == 15332",
          "timestamp_epoch": "1723681328.595654000"
        },
        {
          "tcp_stream": 302,
          "frame_number": 15375,
          "display_filter": "frame.number == 15375",
          "timestamp_epoch": "1723681334.274261000"
        },
        {
          "tcp_stream": 303,
          "frame_number": 15391,
          "display_filter": "frame.number == 15391",
          "timestamp_epoch": "1723681341.576410000"
        },
        {
          "tcp_stream": 304,
          "frame_number": 15405,
          "display_filter": "frame.number == 15405",
          "timestamp_epoch": "1723681347.954525000"
        },
        {
          "tcp_stream": 305,
          "frame_number": 15414,
          "display_filter": "frame.number == 15414",
          "timestamp_epoch": "1723681352.496784000"
        },
        {
          "tcp_stream": 306,
          "frame_number": 15423,
          "display_filter": "frame.number == 15423",
          "timestamp_epoch": "1723681357.516311000"
        },
        {
          "tcp_stream": 307,
          "frame_number": 15434,
          "display_filter": "frame.number == 15434",
          "timestamp_epoch": "1723681363.438478000"
        },
        {
          "tcp_stream": 308,
          "frame_number": 15443,
          "display_filter": "frame.number == 15443",
          "timestamp_epoch": "1723681367.610722000"
        },
        {
          "tcp_stream": 309,
          "frame_number": 15454,
          "display_filter": "frame.number == 15454",
          "timestamp_epoch": "1723681372.837324000"
        },
        {
          "tcp_stream": 310,
          "frame_number": 15463,
          "display_filter": "frame.number == 15463",
          "timestamp_epoch": "1723681377.723785000"
        },
        {
          "tcp_stream": 312,
          "frame_number": 15492,
          "display_filter": "frame.number == 15492",
          "timestamp_epoch": "1723681383.397047000"
        }
      ]
    },
    {
      "id": "finding-90a3532518006ab5a519468a",
      "type": "pcap-finding",
      "label": "Repeated unsuccessful DNS resolution",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "domain": "wpad.lafontainebleu.org",
        "source": "10.8.15.133",
        "response_count": 20
      },
      "rule_id": "repeated-nxdomain",
      "severity": "low",
      "confidence": 0.5,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Repeated NXDOMAIN responses may indicate a dead domain, misconfiguration, retrying software, or malicious fallback. They do not establish a domain-generation algorithm.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "udp_stream": 9,
          "frame_number": 56,
          "display_filter": "frame.number == 56",
          "timestamp_epoch": "1723680584.978533000"
        },
        {
          "udp_stream": 10,
          "frame_number": 60,
          "display_filter": "frame.number == 60",
          "timestamp_epoch": "1723680584.996370000"
        },
        {
          "udp_stream": 14,
          "frame_number": 962,
          "display_filter": "frame.number == 962",
          "timestamp_epoch": "1723680599.997451000"
        },
        {
          "udp_stream": 20,
          "frame_number": 964,
          "display_filter": "frame.number == 964",
          "timestamp_epoch": "1723680600.044261000"
        },
        {
          "udp_stream": 22,
          "frame_number": 2106,
          "display_filter": "frame.number == 2106",
          "timestamp_epoch": "1723680618.772193000"
        },
        {
          "udp_stream": 14,
          "frame_number": 3576,
          "display_filter": "frame.number == 3576",
          "timestamp_epoch": "1723680626.785646000"
        },
        {
          "udp_stream": 38,
          "frame_number": 6439,
          "display_filter": "frame.number == 6439",
          "timestamp_epoch": "1723680660.000329000"
        },
        {
          "udp_stream": 20,
          "frame_number": 6441,
          "display_filter": "frame.number == 6441",
          "timestamp_epoch": "1723680660.047965000"
        },
        {
          "udp_stream": 14,
          "frame_number": 6459,
          "display_filter": "frame.number == 6459",
          "timestamp_epoch": "1723680661.692095000"
        },
        {
          "udp_stream": 100,
          "frame_number": 12209,
          "display_filter": "frame.number == 12209",
          "timestamp_epoch": "1723680895.684574000"
        },
        {
          "udp_stream": 100,
          "frame_number": 12410,
          "display_filter": "frame.number == 12410",
          "timestamp_epoch": "1723680911.067621000"
        },
        {
          "udp_stream": 100,
          "frame_number": 13598,
          "display_filter": "frame.number == 13598",
          "timestamp_epoch": "1723680919.077883000"
        },
        {
          "udp_stream": 133,
          "frame_number": 15054,
          "display_filter": "frame.number == 15054",
          "timestamp_epoch": "1723681260.039606000"
        },
        {
          "udp_stream": 20,
          "frame_number": 15056,
          "display_filter": "frame.number == 15056",
          "timestamp_epoch": "1723681260.083829000"
        },
        {
          "udp_stream": 136,
          "frame_number": 15370,
          "display_filter": "frame.number == 15370",
          "timestamp_epoch": "1723681330.394345000"
        },
        {
          "udp_stream": 136,
          "frame_number": 15382,
          "display_filter": "frame.number == 15382",
          "timestamp_epoch": "1723681338.397619000"
        },
        {
          "udp_stream": 20,
          "frame_number": 16701,
          "display_filter": "frame.number == 16701",
          "timestamp_epoch": "1723681860.125139000"
        },
        {
          "udp_stream": 145,
          "frame_number": 16703,
          "display_filter": "frame.number == 16703",
          "timestamp_epoch": "1723681860.169001000"
        },
        {
          "udp_stream": 151,
          "frame_number": 18011,
          "display_filter": "frame.number == 18011",
          "timestamp_epoch": "1723682460.198419000"
        },
        {
          "udp_stream": 20,
          "frame_number": 18013,
          "display_filter": "frame.number == 18013",
          "timestamp_epoch": "1723682460.256763000"
        }
      ]
    },
    {
      "id": "finding-130344072143303b93081c2d",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.8.15.133",
        "protocol": "drsuapi",
        "destination": "10.8.15.4",
        "event_count": 69,
        "operation_numbers": [
          "0",
          "1",
          "12",
          "13",
          "30"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 281,
          "display_filter": "frame.number == 281",
          "timestamp_epoch": "1723680586.162496000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 285,
          "display_filter": "frame.number == 285",
          "timestamp_epoch": "1723680586.163355000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 292,
          "display_filter": "frame.number == 292",
          "timestamp_epoch": "1723680586.164365000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 297,
          "display_filter": "frame.number == 297",
          "timestamp_epoch": "1723680586.165243000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 312,
          "display_filter": "frame.number == 312",
          "timestamp_epoch": "1723680586.175079000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 314,
          "display_filter": "frame.number == 314",
          "timestamp_epoch": "1723680586.183783000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 316,
          "display_filter": "frame.number == 316",
          "timestamp_epoch": "1723680586.185886000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 331,
          "display_filter": "frame.number == 331",
          "timestamp_epoch": "1723680586.222611000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 335,
          "display_filter": "frame.number == 335",
          "timestamp_epoch": "1723680586.223909000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 348,
          "display_filter": "frame.number == 348",
          "timestamp_epoch": "1723680586.231259000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 405,
          "display_filter": "frame.number == 405",
          "timestamp_epoch": "1723680586.407343000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 407,
          "display_filter": "frame.number == 407",
          "timestamp_epoch": "1723680586.408227000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 411,
          "display_filter": "frame.number == 411",
          "timestamp_epoch": "1723680586.417183000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 418,
          "display_filter": "frame.number == 418",
          "timestamp_epoch": "1723680586.419421000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 423,
          "display_filter": "frame.number == 423",
          "timestamp_epoch": "1723680586.421509000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 425,
          "display_filter": "frame.number == 425",
          "timestamp_epoch": "1723680586.422332000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 427,
          "display_filter": "frame.number == 427",
          "timestamp_epoch": "1723680586.425984000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 776,
          "display_filter": "frame.number == 776",
          "timestamp_epoch": "1723680589.063397000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 778,
          "display_filter": "frame.number == 778",
          "timestamp_epoch": "1723680589.064122000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 780,
          "display_filter": "frame.number == 780",
          "timestamp_epoch": "1723680589.064730000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 784,
          "display_filter": "frame.number == 784",
          "timestamp_epoch": "1723680589.066298000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 786,
          "display_filter": "frame.number == 786",
          "timestamp_epoch": "1723680589.066760000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 788,
          "display_filter": "frame.number == 788",
          "timestamp_epoch": "1723680589.067268000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1022,
          "display_filter": "frame.number == 1022",
          "timestamp_epoch": "1723680608.254938000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1024,
          "display_filter": "frame.number == 1024",
          "timestamp_epoch": "1723680608.255330000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1026,
          "display_filter": "frame.number == 1026",
          "timestamp_epoch": "1723680608.255819000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1028,
          "display_filter": "frame.number == 1028",
          "timestamp_epoch": "1723680608.256225000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2170,
          "display_filter": "frame.number == 2170",
          "timestamp_epoch": "1723680619.142078000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2173,
          "display_filter": "frame.number == 2173",
          "timestamp_epoch": "1723680619.142601000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2176,
          "display_filter": "frame.number == 2176",
          "timestamp_epoch": "1723680619.143163000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2184,
          "display_filter": "frame.number == 2184",
          "timestamp_epoch": "1723680619.146051000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2186,
          "display_filter": "frame.number == 2186",
          "timestamp_epoch": "1723680619.146435000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2188,
          "display_filter": "frame.number == 2188",
          "timestamp_epoch": "1723680619.146901000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8771,
          "display_filter": "frame.number == 8771",
          "timestamp_epoch": "1723680669.170554000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8773,
          "display_filter": "frame.number == 8773",
          "timestamp_epoch": "1723680669.171234000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8775,
          "display_filter": "frame.number == 8775",
          "timestamp_epoch": "1723680669.171828000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8779,
          "display_filter": "frame.number == 8779",
          "timestamp_epoch": "1723680669.173716000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8781,
          "display_filter": "frame.number == 8781",
          "timestamp_epoch": "1723680669.174116000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8783,
          "display_filter": "frame.number == 8783",
          "timestamp_epoch": "1723680669.174611000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10324,
          "display_filter": "frame.number == 10324",
          "timestamp_epoch": "1723680707.872008000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10326,
          "display_filter": "frame.number == 10326",
          "timestamp_epoch": "1723680707.872467000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10328,
          "display_filter": "frame.number == 10328",
          "timestamp_epoch": "1723680707.873023000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10332,
          "display_filter": "frame.number == 10332",
          "timestamp_epoch": "1723680707.874681000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10334,
          "display_filter": "frame.number == 10334",
          "timestamp_epoch": "1723680707.875077000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10336,
          "display_filter": "frame.number == 10336",
          "timestamp_epoch": "1723680707.875542000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10792,
          "display_filter": "frame.number == 10792",
          "timestamp_epoch": "1723680726.271910000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10794,
          "display_filter": "frame.number == 10794",
          "timestamp_epoch": "1723680726.272437000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10796,
          "display_filter": "frame.number == 10796",
          "timestamp_epoch": "1723680726.272994000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10800,
          "display_filter": "frame.number == 10800",
          "timestamp_epoch": "1723680726.274795000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10802,
          "display_filter": "frame.number == 10802",
          "timestamp_epoch": "1723680726.275171000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10804,
          "display_filter": "frame.number == 10804",
          "timestamp_epoch": "1723680726.275611000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11542,
          "display_filter": "frame.number == 11542",
          "timestamp_epoch": "1723680793.575615000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11544,
          "display_filter": "frame.number == 11544",
          "timestamp_epoch": "1723680793.576154000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11546,
          "display_filter": "frame.number == 11546",
          "timestamp_epoch": "1723680793.576710000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11550,
          "display_filter": "frame.number == 11550",
          "timestamp_epoch": "1723680793.578633000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11552,
          "display_filter": "frame.number == 11552",
          "timestamp_epoch": "1723680793.579033000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11554,
          "display_filter": "frame.number == 11554",
          "timestamp_epoch": "1723680793.579501000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13681,
          "display_filter": "frame.number == 13681",
          "timestamp_epoch": "1723680984.938022000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13683,
          "display_filter": "frame.number == 13683",
          "timestamp_epoch": "1723680984.938687000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13685,
          "display_filter": "frame.number == 13685",
          "timestamp_epoch": "1723680984.939327000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13689,
          "display_filter": "frame.number == 13689",
          "timestamp_epoch": "1723680984.940868000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13691,
          "display_filter": "frame.number == 13691",
          "timestamp_epoch": "1723680984.941263000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13693,
          "display_filter": "frame.number == 13693",
          "timestamp_epoch": "1723680984.941752000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13766,
          "display_filter": "frame.number == 13766",
          "timestamp_epoch": "1723680987.861060000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13768,
          "display_filter": "frame.number == 13768",
          "timestamp_epoch": "1723680987.861627000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13770,
          "display_filter": "frame.number == 13770",
          "timestamp_epoch": "1723680987.862317000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13774,
          "display_filter": "frame.number == 13774",
          "timestamp_epoch": "1723680987.864133000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13776,
          "display_filter": "frame.number == 13776",
          "timestamp_epoch": "1723680987.864658000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13778,
          "display_filter": "frame.number == 13778",
          "timestamp_epoch": "1723680987.865145000"
        }
      ]
    },
    {
      "id": "finding-72bc17359c2c979bc54cf1d2",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.8.15.133",
        "protocol": "ldap",
        "destination": "10.8.15.4",
        "event_count": 143,
        "operation_numbers": [
          "",
          "0",
          "2",
          "3"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 0,
          "frame_number": 37,
          "display_filter": "frame.number == 37",
          "timestamp_epoch": "1723680584.316304000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 288,
          "display_filter": "frame.number == 288",
          "timestamp_epoch": "1723680586.163682000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 295,
          "display_filter": "frame.number == 295",
          "timestamp_epoch": "1723680586.165042000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 300,
          "display_filter": "frame.number == 300",
          "timestamp_epoch": "1723680586.167935000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 304,
          "display_filter": "frame.number == 304",
          "timestamp_epoch": "1723680586.169382000"
        },
        {
          "tcp_stream": 0,
          "frame_number": 342,
          "display_filter": "frame.number == 342",
          "timestamp_epoch": "1723680586.228979000"
        },
        {
          "tcp_stream": 0,
          "frame_number": 350,
          "display_filter": "frame.number == 350",
          "timestamp_epoch": "1723680586.232492000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 367,
          "display_filter": "frame.number == 367",
          "timestamp_epoch": "1723680586.333842000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 434,
          "display_filter": "frame.number == 434",
          "timestamp_epoch": "1723680586.460022000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 454,
          "display_filter": "frame.number == 454",
          "timestamp_epoch": "1723680586.566735000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 461,
          "display_filter": "frame.number == 461",
          "timestamp_epoch": "1723680586.570595000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 465,
          "display_filter": "frame.number == 465",
          "timestamp_epoch": "1723680586.571718000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 467,
          "display_filter": "frame.number == 467",
          "timestamp_epoch": "1723680586.572226000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 477,
          "display_filter": "frame.number == 477",
          "timestamp_epoch": "1723680586.858009000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 482,
          "display_filter": "frame.number == 482",
          "timestamp_epoch": "1723680586.861444000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 498,
          "display_filter": "frame.number == 498",
          "timestamp_epoch": "1723680586.918933000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 504,
          "display_filter": "frame.number == 504",
          "timestamp_epoch": "1723680586.923457000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 507,
          "display_filter": "frame.number == 507",
          "timestamp_epoch": "1723680586.925209000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 509,
          "display_filter": "frame.number == 509",
          "timestamp_epoch": "1723680586.927027000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 511,
          "display_filter": "frame.number == 511",
          "timestamp_epoch": "1723680586.927993000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 669,
          "display_filter": "frame.number == 669",
          "timestamp_epoch": "1723680587.233004000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 673,
          "display_filter": "frame.number == 673",
          "timestamp_epoch": "1723680587.260152000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 805,
          "display_filter": "frame.number == 805",
          "timestamp_epoch": "1723680589.322280000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 810,
          "display_filter": "frame.number == 810",
          "timestamp_epoch": "1723680589.324404000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 813,
          "display_filter": "frame.number == 813",
          "timestamp_epoch": "1723680589.327099000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 815,
          "display_filter": "frame.number == 815",
          "timestamp_epoch": "1723680589.327801000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 817,
          "display_filter": "frame.number == 817",
          "timestamp_epoch": "1723680589.328308000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 823,
          "display_filter": "frame.number == 823",
          "timestamp_epoch": "1723680589.330954000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 826,
          "display_filter": "frame.number == 826",
          "timestamp_epoch": "1723680589.331945000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 831,
          "display_filter": "frame.number == 831",
          "timestamp_epoch": "1723680589.332615000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 833,
          "display_filter": "frame.number == 833",
          "timestamp_epoch": "1723680589.333097000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 835,
          "display_filter": "frame.number == 835",
          "timestamp_epoch": "1723680589.333557000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 892,
          "display_filter": "frame.number == 892",
          "timestamp_epoch": "1723680594.911094000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 897,
          "display_filter": "frame.number == 897",
          "timestamp_epoch": "1723680594.913590000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 900,
          "display_filter": "frame.number == 900",
          "timestamp_epoch": "1723680594.916130000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 902,
          "display_filter": "frame.number == 902",
          "timestamp_epoch": "1723680594.916675000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 904,
          "display_filter": "frame.number == 904",
          "timestamp_epoch": "1723680594.917132000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 906,
          "display_filter": "frame.number == 906",
          "timestamp_epoch": "1723680594.917721000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 908,
          "display_filter": "frame.number == 908",
          "timestamp_epoch": "1723680594.918472000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 914,
          "display_filter": "frame.number == 914",
          "timestamp_epoch": "1723680594.931067000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 917,
          "display_filter": "frame.number == 917",
          "timestamp_epoch": "1723680594.932325000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 949,
          "display_filter": "frame.number == 949",
          "timestamp_epoch": "1723680594.937953000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 951,
          "display_filter": "frame.number == 951",
          "timestamp_epoch": "1723680594.938627000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 955,
          "display_filter": "frame.number == 955",
          "timestamp_epoch": "1723680594.939118000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1034,
          "display_filter": "frame.number == 1034",
          "timestamp_epoch": "1723680608.262175000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1037,
          "display_filter": "frame.number == 1037",
          "timestamp_epoch": "1723680608.266520000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1043,
          "display_filter": "frame.number == 1043",
          "timestamp_epoch": "1723680608.269420000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1046,
          "display_filter": "frame.number == 1046",
          "timestamp_epoch": "1723680608.270460000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1048,
          "display_filter": "frame.number == 1048",
          "timestamp_epoch": "1723680608.270835000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1050,
          "display_filter": "frame.number == 1050",
          "timestamp_epoch": "1723680608.271287000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1083,
          "display_filter": "frame.number == 1083",
          "timestamp_epoch": "1723680608.286720000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1085,
          "display_filter": "frame.number == 1085",
          "timestamp_epoch": "1723680608.289999000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2193,
          "display_filter": "frame.number == 2193",
          "timestamp_epoch": "1723680619.150261000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2198,
          "display_filter": "frame.number == 2198",
          "timestamp_epoch": "1723680619.151800000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2201,
          "display_filter": "frame.number == 2201",
          "timestamp_epoch": "1723680619.152947000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2203,
          "display_filter": "frame.number == 2203",
          "timestamp_epoch": "1723680619.153458000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2205,
          "display_filter": "frame.number == 2205",
          "timestamp_epoch": "1723680619.153878000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2211,
          "display_filter": "frame.number == 2211",
          "timestamp_epoch": "1723680619.157530000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2214,
          "display_filter": "frame.number == 2214",
          "timestamp_epoch": "1723680619.158686000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2219,
          "display_filter": "frame.number == 2219",
          "timestamp_epoch": "1723680619.159464000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2221,
          "display_filter": "frame.number == 2221",
          "timestamp_epoch": "1723680619.160052000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2224,
          "display_filter": "frame.number == 2224",
          "timestamp_epoch": "1723680619.160335000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8788,
          "display_filter": "frame.number == 8788",
          "timestamp_epoch": "1723680669.177116000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8793,
          "display_filter": "frame.number == 8793",
          "timestamp_epoch": "1723680669.178289000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8796,
          "display_filter": "frame.number == 8796",
          "timestamp_epoch": "1723680669.179482000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8798,
          "display_filter": "frame.number == 8798",
          "timestamp_epoch": "1723680669.179947000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8800,
          "display_filter": "frame.number == 8800",
          "timestamp_epoch": "1723680669.180357000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8806,
          "display_filter": "frame.number == 8806",
          "timestamp_epoch": "1723680669.183217000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8809,
          "display_filter": "frame.number == 8809",
          "timestamp_epoch": "1723680669.184395000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8814,
          "display_filter": "frame.number == 8814",
          "timestamp_epoch": "1723680669.185005000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8816,
          "display_filter": "frame.number == 8816",
          "timestamp_epoch": "1723680669.185491000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8820,
          "display_filter": "frame.number == 8820",
          "timestamp_epoch": "1723680669.186001000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10341,
          "display_filter": "frame.number == 10341",
          "timestamp_epoch": "1723680707.878189000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10346,
          "display_filter": "frame.number == 10346",
          "timestamp_epoch": "1723680707.879339000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10349,
          "display_filter": "frame.number == 10349",
          "timestamp_epoch": "1723680707.880452000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10351,
          "display_filter": "frame.number == 10351",
          "timestamp_epoch": "1723680707.880893000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10353,
          "display_filter": "frame.number == 10353",
          "timestamp_epoch": "1723680707.881264000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10359,
          "display_filter": "frame.number == 10359",
          "timestamp_epoch": "1723680707.884542000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10362,
          "display_filter": "frame.number == 10362",
          "timestamp_epoch": "1723680707.885559000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10367,
          "display_filter": "frame.number == 10367",
          "timestamp_epoch": "1723680707.886071000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10369,
          "display_filter": "frame.number == 10369",
          "timestamp_epoch": "1723680707.886516000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10373,
          "display_filter": "frame.number == 10373",
          "timestamp_epoch": "1723680707.886942000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10809,
          "display_filter": "frame.number == 10809",
          "timestamp_epoch": "1723680726.278208000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10814,
          "display_filter": "frame.number == 10814",
          "timestamp_epoch": "1723680726.279327000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10817,
          "display_filter": "frame.number == 10817",
          "timestamp_epoch": "1723680726.280306000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10819,
          "display_filter": "frame.number == 10819",
          "timestamp_epoch": "1723680726.280781000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10821,
          "display_filter": "frame.number == 10821",
          "timestamp_epoch": "1723680726.281165000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10827,
          "display_filter": "frame.number == 10827",
          "timestamp_epoch": "1723680726.284604000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10830,
          "display_filter": "frame.number == 10830",
          "timestamp_epoch": "1723680726.285727000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10835,
          "display_filter": "frame.number == 10835",
          "timestamp_epoch": "1723680726.286321000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10837,
          "display_filter": "frame.number == 10837",
          "timestamp_epoch": "1723680726.286818000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10841,
          "display_filter": "frame.number == 10841",
          "timestamp_epoch": "1723680726.287221000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11559,
          "display_filter": "frame.number == 11559",
          "timestamp_epoch": "1723680793.582099000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11564,
          "display_filter": "frame.number == 11564",
          "timestamp_epoch": "1723680793.583308000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11567,
          "display_filter": "frame.number == 11567",
          "timestamp_epoch": "1723680793.584848000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11569,
          "display_filter": "frame.number == 11569",
          "timestamp_epoch": "1723680793.585396000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11571,
          "display_filter": "frame.number == 11571",
          "timestamp_epoch": "1723680793.585855000"
        },
        {
          "tcp_stream": 149,
          "frame_number": 11577,
          "display_filter": "frame.number == 11577",
          "timestamp_epoch": "1723680793.589691000"
        },
        {
          "tcp_stream": 149,
          "frame_number": 11580,
          "display_filter": "frame.number == 11580",
          "timestamp_epoch": "1723680793.590821000"
        },
        {
          "tcp_stream": 149,
          "frame_number": 11585,
          "display_filter": "frame.number == 11585",
          "timestamp_epoch": "1723680793.591360000"
        }
      ]
    },
    {
      "id": "finding-d35456ec17991fe1b149580c",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.8.15.133",
        "protocol": "samr",
        "destination": "10.8.15.4",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 1096,
          "display_filter": "frame.number == 1096",
          "timestamp_epoch": "1723680608.292494000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1098,
          "display_filter": "frame.number == 1098",
          "timestamp_epoch": "1723680608.293037000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1100,
          "display_filter": "frame.number == 1100",
          "timestamp_epoch": "1723680608.293468000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1102,
          "display_filter": "frame.number == 1102",
          "timestamp_epoch": "1723680608.294014000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1104,
          "display_filter": "frame.number == 1104",
          "timestamp_epoch": "1723680608.294498000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1106,
          "display_filter": "frame.number == 1106",
          "timestamp_epoch": "1723680608.295053000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1108,
          "display_filter": "frame.number == 1108",
          "timestamp_epoch": "1723680608.295580000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1110,
          "display_filter": "frame.number == 1110",
          "timestamp_epoch": "1723680608.296214000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1112,
          "display_filter": "frame.number == 1112",
          "timestamp_epoch": "1723680608.296855000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1114,
          "display_filter": "frame.number == 1114",
          "timestamp_epoch": "1723680608.297426000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1116,
          "display_filter": "frame.number == 1116",
          "timestamp_epoch": "1723680608.297908000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1118,
          "display_filter": "frame.number == 1118",
          "timestamp_epoch": "1723680608.298462000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1120,
          "display_filter": "frame.number == 1120",
          "timestamp_epoch": "1723680608.298892000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1122,
          "display_filter": "frame.number == 1122",
          "timestamp_epoch": "1723680608.299311000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1124,
          "display_filter": "frame.number == 1124",
          "timestamp_epoch": "1723680608.299700000"
        }
      ]
    },
    {
      "id": "finding-dadf48afcfbbcf2b5157e015",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.8.15.4",
        "protocol": "drsuapi",
        "destination": "10.8.15.133",
        "event_count": 69,
        "operation_numbers": [
          "0",
          "1",
          "12",
          "13",
          "30"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 11,
          "frame_number": 282,
          "display_filter": "frame.number == 282",
          "timestamp_epoch": "1723680586.162688000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 287,
          "display_filter": "frame.number == 287",
          "timestamp_epoch": "1723680586.163662000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 293,
          "display_filter": "frame.number == 293",
          "timestamp_epoch": "1723680586.164600000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 298,
          "display_filter": "frame.number == 298",
          "timestamp_epoch": "1723680586.165377000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 313,
          "display_filter": "frame.number == 313",
          "timestamp_epoch": "1723680586.175336000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 315,
          "display_filter": "frame.number == 315",
          "timestamp_epoch": "1723680586.184129000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 317,
          "display_filter": "frame.number == 317",
          "timestamp_epoch": "1723680586.186040000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 333,
          "display_filter": "frame.number == 333",
          "timestamp_epoch": "1723680586.223085000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 336,
          "display_filter": "frame.number == 336",
          "timestamp_epoch": "1723680586.224242000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 349,
          "display_filter": "frame.number == 349",
          "timestamp_epoch": "1723680586.231483000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 406,
          "display_filter": "frame.number == 406",
          "timestamp_epoch": "1723680586.407559000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 408,
          "display_filter": "frame.number == 408",
          "timestamp_epoch": "1723680586.408786000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 415,
          "display_filter": "frame.number == 415",
          "timestamp_epoch": "1723680586.417890000"
        },
        {
          "tcp_stream": 22,
          "frame_number": 420,
          "display_filter": "frame.number == 420",
          "timestamp_epoch": "1723680586.419690000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 424,
          "display_filter": "frame.number == 424",
          "timestamp_epoch": "1723680586.421823000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 426,
          "display_filter": "frame.number == 426",
          "timestamp_epoch": "1723680586.422890000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 428,
          "display_filter": "frame.number == 428",
          "timestamp_epoch": "1723680586.426156000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 777,
          "display_filter": "frame.number == 777",
          "timestamp_epoch": "1723680589.063735000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 779,
          "display_filter": "frame.number == 779",
          "timestamp_epoch": "1723680589.064448000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 781,
          "display_filter": "frame.number == 781",
          "timestamp_epoch": "1723680589.064904000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 785,
          "display_filter": "frame.number == 785",
          "timestamp_epoch": "1723680589.066447000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 787,
          "display_filter": "frame.number == 787",
          "timestamp_epoch": "1723680589.066986000"
        },
        {
          "tcp_stream": 35,
          "frame_number": 789,
          "display_filter": "frame.number == 789",
          "timestamp_epoch": "1723680589.067414000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1023,
          "display_filter": "frame.number == 1023",
          "timestamp_epoch": "1723680608.255139000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1025,
          "display_filter": "frame.number == 1025",
          "timestamp_epoch": "1723680608.255622000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1027,
          "display_filter": "frame.number == 1027",
          "timestamp_epoch": "1723680608.256076000"
        },
        {
          "tcp_stream": 11,
          "frame_number": 1029,
          "display_filter": "frame.number == 1029",
          "timestamp_epoch": "1723680608.256355000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2171,
          "display_filter": "frame.number == 2171",
          "timestamp_epoch": "1723680619.142315000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2175,
          "display_filter": "frame.number == 2175",
          "timestamp_epoch": "1723680619.142979000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2179,
          "display_filter": "frame.number == 2179",
          "timestamp_epoch": "1723680619.143304000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2185,
          "display_filter": "frame.number == 2185",
          "timestamp_epoch": "1723680619.146253000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2187,
          "display_filter": "frame.number == 2187",
          "timestamp_epoch": "1723680619.146719000"
        },
        {
          "tcp_stream": 75,
          "frame_number": 2189,
          "display_filter": "frame.number == 2189",
          "timestamp_epoch": "1723680619.147091000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8772,
          "display_filter": "frame.number == 8772",
          "timestamp_epoch": "1723680669.170822000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8774,
          "display_filter": "frame.number == 8774",
          "timestamp_epoch": "1723680669.171583000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8776,
          "display_filter": "frame.number == 8776",
          "timestamp_epoch": "1723680669.172016000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8780,
          "display_filter": "frame.number == 8780",
          "timestamp_epoch": "1723680669.173916000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8782,
          "display_filter": "frame.number == 8782",
          "timestamp_epoch": "1723680669.174421000"
        },
        {
          "tcp_stream": 116,
          "frame_number": 8784,
          "display_filter": "frame.number == 8784",
          "timestamp_epoch": "1723680669.174776000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10325,
          "display_filter": "frame.number == 10325",
          "timestamp_epoch": "1723680707.872244000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10327,
          "display_filter": "frame.number == 10327",
          "timestamp_epoch": "1723680707.872807000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10329,
          "display_filter": "frame.number == 10329",
          "timestamp_epoch": "1723680707.873195000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10333,
          "display_filter": "frame.number == 10333",
          "timestamp_epoch": "1723680707.874883000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10335,
          "display_filter": "frame.number == 10335",
          "timestamp_epoch": "1723680707.875361000"
        },
        {
          "tcp_stream": 129,
          "frame_number": 10337,
          "display_filter": "frame.number == 10337",
          "timestamp_epoch": "1723680707.875719000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10793,
          "display_filter": "frame.number == 10793",
          "timestamp_epoch": "1723680726.272191000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10795,
          "display_filter": "frame.number == 10795",
          "timestamp_epoch": "1723680726.272794000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10797,
          "display_filter": "frame.number == 10797",
          "timestamp_epoch": "1723680726.273174000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10801,
          "display_filter": "frame.number == 10801",
          "timestamp_epoch": "1723680726.274984000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10803,
          "display_filter": "frame.number == 10803",
          "timestamp_epoch": "1723680726.275430000"
        },
        {
          "tcp_stream": 136,
          "frame_number": 10805,
          "display_filter": "frame.number == 10805",
          "timestamp_epoch": "1723680726.275772000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11543,
          "display_filter": "frame.number == 11543",
          "timestamp_epoch": "1723680793.575868000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11545,
          "display_filter": "frame.number == 11545",
          "timestamp_epoch": "1723680793.576475000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11547,
          "display_filter": "frame.number == 11547",
          "timestamp_epoch": "1723680793.576876000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11551,
          "display_filter": "frame.number == 11551",
          "timestamp_epoch": "1723680793.578827000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11553,
          "display_filter": "frame.number == 11553",
          "timestamp_epoch": "1723680793.579321000"
        },
        {
          "tcp_stream": 147,
          "frame_number": 11555,
          "display_filter": "frame.number == 11555",
          "timestamp_epoch": "1723680793.579650000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13682,
          "display_filter": "frame.number == 13682",
          "timestamp_epoch": "1723680984.938304000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13684,
          "display_filter": "frame.number == 13684",
          "timestamp_epoch": "1723680984.939080000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13686,
          "display_filter": "frame.number == 13686",
          "timestamp_epoch": "1723680984.939542000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13690,
          "display_filter": "frame.number == 13690",
          "timestamp_epoch": "1723680984.941065000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13692,
          "display_filter": "frame.number == 13692",
          "timestamp_epoch": "1723680984.941557000"
        },
        {
          "tcp_stream": 212,
          "frame_number": 13694,
          "display_filter": "frame.number == 13694",
          "timestamp_epoch": "1723680984.941918000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13767,
          "display_filter": "frame.number == 13767",
          "timestamp_epoch": "1723680987.861338000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13769,
          "display_filter": "frame.number == 13769",
          "timestamp_epoch": "1723680987.862048000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13771,
          "display_filter": "frame.number == 13771",
          "timestamp_epoch": "1723680987.862579000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13775,
          "display_filter": "frame.number == 13775",
          "timestamp_epoch": "1723680987.864410000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13777,
          "display_filter": "frame.number == 13777",
          "timestamp_epoch": "1723680987.864959000"
        },
        {
          "tcp_stream": 217,
          "frame_number": 13779,
          "display_filter": "frame.number == 13779",
          "timestamp_epoch": "1723680987.865321000"
        }
      ]
    },
    {
      "id": "finding-9da2803215a49174d050ddf4",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.8.15.4",
        "protocol": "ldap",
        "destination": "10.8.15.133",
        "event_count": 113,
        "operation_numbers": [
          "",
          "1",
          "4,19,19,19,5",
          "4,5",
          "5"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 0,
          "frame_number": 39,
          "display_filter": "frame.number == 39",
          "timestamp_epoch": "1723680584.316590000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 290,
          "display_filter": "frame.number == 290",
          "timestamp_epoch": "1723680586.163947000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 299,
          "display_filter": "frame.number == 299",
          "timestamp_epoch": "1723680586.165682000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 302,
          "display_filter": "frame.number == 302",
          "timestamp_epoch": "1723680586.168128000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 305,
          "display_filter": "frame.number == 305",
          "timestamp_epoch": "1723680586.169656000"
        },
        {
          "tcp_stream": 0,
          "frame_number": 345,
          "display_filter": "frame.number == 345",
          "timestamp_epoch": "1723680586.229864000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 370,
          "display_filter": "frame.number == 370",
          "timestamp_epoch": "1723680586.334337000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 436,
          "display_filter": "frame.number == 436",
          "timestamp_epoch": "1723680586.460412000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 456,
          "display_filter": "frame.number == 456",
          "timestamp_epoch": "1723680586.567224000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 464,
          "display_filter": "frame.number == 464",
          "timestamp_epoch": "1723680586.571159000"
        },
        {
          "tcp_stream": 19,
          "frame_number": 466,
          "display_filter": "frame.number == 466",
          "timestamp_epoch": "1723680586.572032000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 479,
          "display_filter": "frame.number == 479",
          "timestamp_epoch": "1723680586.858347000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 484,
          "display_filter": "frame.number == 484",
          "timestamp_epoch": "1723680586.862253000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 499,
          "display_filter": "frame.number == 499",
          "timestamp_epoch": "1723680586.919299000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 506,
          "display_filter": "frame.number == 506",
          "timestamp_epoch": "1723680586.924302000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 508,
          "display_filter": "frame.number == 508",
          "timestamp_epoch": "1723680586.925448000"
        },
        {
          "tcp_stream": 29,
          "frame_number": 510,
          "display_filter": "frame.number == 510",
          "timestamp_epoch": "1723680586.927291000"
        },
        {
          "tcp_stream": 27,
          "frame_number": 512,
          "display_filter": "frame.number == 512",
          "timestamp_epoch": "1723680586.928362000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 807,
          "display_filter": "frame.number == 807",
          "timestamp_epoch": "1723680589.322588000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 812,
          "display_filter": "frame.number == 812",
          "timestamp_epoch": "1723680589.325251000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 814,
          "display_filter": "frame.number == 814",
          "timestamp_epoch": "1723680589.327512000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 816,
          "display_filter": "frame.number == 816",
          "timestamp_epoch": "1723680589.328051000"
        },
        {
          "tcp_stream": 36,
          "frame_number": 818,
          "display_filter": "frame.number == 818",
          "timestamp_epoch": "1723680589.328531000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 825,
          "display_filter": "frame.number == 825",
          "timestamp_epoch": "1723680589.331594000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 829,
          "display_filter": "frame.number == 829",
          "timestamp_epoch": "1723680589.332163000"
        },
        {
          "tcp_stream": 37,
          "frame_number": 832,
          "display_filter": "frame.number == 832",
          "timestamp_epoch": "1723680589.332847000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 894,
          "display_filter": "frame.number == 894",
          "timestamp_epoch": "1723680594.911658000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 899,
          "display_filter": "frame.number == 899",
          "timestamp_epoch": "1723680594.914633000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 901,
          "display_filter": "frame.number == 901",
          "timestamp_epoch": "1723680594.916365000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 903,
          "display_filter": "frame.number == 903",
          "timestamp_epoch": "1723680594.916837000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 905,
          "display_filter": "frame.number == 905",
          "timestamp_epoch": "1723680594.917418000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 907,
          "display_filter": "frame.number == 907",
          "timestamp_epoch": "1723680594.918030000"
        },
        {
          "tcp_stream": 39,
          "frame_number": 909,
          "display_filter": "frame.number == 909",
          "timestamp_epoch": "1723680594.918864000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 916,
          "display_filter": "frame.number == 916",
          "timestamp_epoch": "1723680594.931841000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 918,
          "display_filter": "frame.number == 918",
          "timestamp_epoch": "1723680594.932466000"
        },
        {
          "tcp_stream": 40,
          "frame_number": 950,
          "display_filter": "frame.number == 950",
          "timestamp_epoch": "1723680594.938268000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1036,
          "display_filter": "frame.number == 1036",
          "timestamp_epoch": "1723680608.263016000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1038,
          "display_filter": "frame.number == 1038",
          "timestamp_epoch": "1723680608.266867000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1045,
          "display_filter": "frame.number == 1045",
          "timestamp_epoch": "1723680608.270141000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1047,
          "display_filter": "frame.number == 1047",
          "timestamp_epoch": "1723680608.270637000"
        },
        {
          "tcp_stream": 49,
          "frame_number": 1049,
          "display_filter": "frame.number == 1049",
          "timestamp_epoch": "1723680608.271050000"
        },
        {
          "tcp_stream": 48,
          "frame_number": 1051,
          "display_filter": "frame.number == 1051",
          "timestamp_epoch": "1723680608.271601000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2195,
          "display_filter": "frame.number == 2195",
          "timestamp_epoch": "1723680619.150540000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2200,
          "display_filter": "frame.number == 2200",
          "timestamp_epoch": "1723680619.152525000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2202,
          "display_filter": "frame.number == 2202",
          "timestamp_epoch": "1723680619.153176000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2204,
          "display_filter": "frame.number == 2204",
          "timestamp_epoch": "1723680619.153636000"
        },
        {
          "tcp_stream": 76,
          "frame_number": 2206,
          "display_filter": "frame.number == 2206",
          "timestamp_epoch": "1723680619.154056000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2213,
          "display_filter": "frame.number == 2213",
          "timestamp_epoch": "1723680619.158222000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2217,
          "display_filter": "frame.number == 2217",
          "timestamp_epoch": "1723680619.158932000"
        },
        {
          "tcp_stream": 77,
          "frame_number": 2220,
          "display_filter": "frame.number == 2220",
          "timestamp_epoch": "1723680619.159752000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8790,
          "display_filter": "frame.number == 8790",
          "timestamp_epoch": "1723680669.177405000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8795,
          "display_filter": "frame.number == 8795",
          "timestamp_epoch": "1723680669.179140000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8797,
          "display_filter": "frame.number == 8797",
          "timestamp_epoch": "1723680669.179708000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8799,
          "display_filter": "frame.number == 8799",
          "timestamp_epoch": "1723680669.180172000"
        },
        {
          "tcp_stream": 117,
          "frame_number": 8801,
          "display_filter": "frame.number == 8801",
          "timestamp_epoch": "1723680669.180565000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8808,
          "display_filter": "frame.number == 8808",
          "timestamp_epoch": "1723680669.183920000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8812,
          "display_filter": "frame.number == 8812",
          "timestamp_epoch": "1723680669.184677000"
        },
        {
          "tcp_stream": 118,
          "frame_number": 8815,
          "display_filter": "frame.number == 8815",
          "timestamp_epoch": "1723680669.185287000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10343,
          "display_filter": "frame.number == 10343",
          "timestamp_epoch": "1723680707.878499000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10348,
          "display_filter": "frame.number == 10348",
          "timestamp_epoch": "1723680707.880056000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10350,
          "display_filter": "frame.number == 10350",
          "timestamp_epoch": "1723680707.880675000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10352,
          "display_filter": "frame.number == 10352",
          "timestamp_epoch": "1723680707.881085000"
        },
        {
          "tcp_stream": 130,
          "frame_number": 10354,
          "display_filter": "frame.number == 10354",
          "timestamp_epoch": "1723680707.881451000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10361,
          "display_filter": "frame.number == 10361",
          "timestamp_epoch": "1723680707.885178000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10365,
          "display_filter": "frame.number == 10365",
          "timestamp_epoch": "1723680707.885810000"
        },
        {
          "tcp_stream": 131,
          "frame_number": 10368,
          "display_filter": "frame.number == 10368",
          "timestamp_epoch": "1723680707.886329000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10811,
          "display_filter": "frame.number == 10811",
          "timestamp_epoch": "1723680726.278478000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10816,
          "display_filter": "frame.number == 10816",
          "timestamp_epoch": "1723680726.279932000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10818,
          "display_filter": "frame.number == 10818",
          "timestamp_epoch": "1723680726.280560000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10820,
          "display_filter": "frame.number == 10820",
          "timestamp_epoch": "1723680726.280982000"
        },
        {
          "tcp_stream": 137,
          "frame_number": 10822,
          "display_filter": "frame.number == 10822",
          "timestamp_epoch": "1723680726.281360000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10829,
          "display_filter": "frame.number == 10829",
          "timestamp_epoch": "1723680726.285345000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10833,
          "display_filter": "frame.number == 10833",
          "timestamp_epoch": "1723680726.285995000"
        },
        {
          "tcp_stream": 138,
          "frame_number": 10836,
          "display_filter": "frame.number == 10836",
          "timestamp_epoch": "1723680726.286605000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11561,
          "display_filter": "frame.number == 11561",
          "timestamp_epoch": "1723680793.582360000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11566,
          "display_filter": "frame.number == 11566",
          "timestamp_epoch": "1723680793.584069000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11568,
          "display_filter": "frame.number == 11568",
          "timestamp_epoch": "1723680793.585134000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11570,
          "display_filter": "frame.number == 11570",
          "timestamp_epoch": "1723680793.585635000"
        },
        {
          "tcp_stream": 148,
          "frame_number": 11572,
          "display_filter": "frame.number == 11572",
          "timestamp_epoch": "1723680793.586076000"
        },
        {
          "tcp_stream": 149,
          "frame_number": 11579,
          "display_filter": "frame.number == 11579",
          "timestamp_epoch": "1723680793.590422000"
        },
        {
          "tcp_stream": 149,
          "frame_number": 11583,
          "display_filter": "frame.number == 11583",
          "timestamp_epoch": "1723680793.591070000"
        },
        {
          "tcp_stream": 149,
          "frame_number": 11586,
          "display_filter": "frame.number == 11586",
          "timestamp_epoch": "1723680793.591623000"
        },
        {
          "tcp_stream": 152,
          "frame_number": 11639,
          "display_filter": "frame.number == 11639",
          "timestamp_epoch": "1723680795.693019000"
        },
        {
          "tcp_stream": 152,
          "frame_number": 11656,
          "display_filter": "frame.number == 11656",
          "timestamp_epoch": "1723680795.703747000"
        },
        {
          "tcp_stream": 152,
          "frame_number": 11658,
          "display_filter": "frame.number == 11658",
          "timestamp_epoch": "1723680795.705808000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 11673,
          "display_filter": "frame.number == 11673",
          "timestamp_epoch": "1723680795.729326000"
        },
        {
          "tcp_stream": 154,
          "frame_number": 11675,
          "display_filter": "frame.number == 11675",
          "timestamp_epoch": "1723680795.729993000"
        },
        {
          "tcp_stream": 196,
          "frame_number": 12513,
          "display_filter": "frame.number == 12513",
          "timestamp_epoch": "1723680911.761516000"
        },
        {
          "tcp_stream": 196,
          "frame_number": 12518,
          "display_filter": "frame.number == 12518",
          "timestamp_epoch": "1723680911.763442000"
        },
        {
          "tcp_stream": 196,
          "frame_number": 12520,
          "display_filter": "frame.number == 12520",
          "timestamp_epoch": "1723680911.765039000"
        },
        {
          "tcp_stream": 197,
          "frame_number": 12529,
          "display_filter": "frame.number == 12529",
          "timestamp_epoch": "1723680911.774536000"
        },
        {
          "tcp_stream": 197,
          "frame_number": 12531,
          "display_filter": "frame.number == 12531",
          "timestamp_epoch": "1723680911.784208000"
        },
        {
          "tcp_stream": 213,
          "frame_number": 13700,
          "display_filter": "frame.number == 13700",
          "timestamp_epoch": "1723680984.944342000"
        },
        {
          "tcp_stream": 213,
          "frame_number": 13705,
          "display_filter": "frame.number == 13705",
          "timestamp_epoch": "1723680984.945807000"
        },
        {
          "tcp_stream": 213,
          "frame_number": 13707,
          "display_filter": "frame.number == 13707",
          "timestamp_epoch": "1723680984.946341000"
        },
        {
          "tcp_stream": 213,
          "frame_number": 13709,
          "display_filter": "frame.number == 13709",
          "timestamp_epoch": "1723680984.946751000"
        },
        {
          "tcp_stream": 213,
          "frame_number": 13711,
          "display_filter": "frame.number == 13711",
          "timestamp_epoch": "1723680984.947134000"
        },
        {
          "tcp_stream": 214,
          "frame_number": 13718,
          "display_filter": "frame.number == 13718",
          "timestamp_epoch": "1723680984.950226000"
        },
        {
          "tcp_stream": 214,
          "frame_number": 13722,
          "display_filter": "frame.number == 13722",
          "timestamp_epoch": "1723680984.950762000"
        },
        {
          "tcp_stream": 214,
          "frame_number": 13725,
          "display_filter": "frame.number == 13725",
          "timestamp_epoch": "1723680984.951327000"
        }
      ]
    },
    {
      "id": "finding-8367718ddef3981991b6f583",
      "type": "pcap-finding",
      "label": "Directory-service protocol activity",
      "source": "deterministic-pcap-analysis",
      "metrics": {
        "source": "10.8.15.4",
        "protocol": "samr",
        "destination": "10.8.15.133",
        "event_count": 15,
        "operation_numbers": [
          "1",
          "16",
          "17",
          "3",
          "34",
          "36",
          "39",
          "5",
          "6",
          "64",
          "7"
        ]
      },
      "rule_id": "directory-service-activity",
      "severity": "low",
      "confidence": 0.95,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "rule_version": "pcap-rules-v3",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 1097,
          "display_filter": "frame.number == 1097",
          "timestamp_epoch": "1723680608.292835000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1099,
          "display_filter": "frame.number == 1099",
          "timestamp_epoch": "1723680608.293290000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1101,
          "display_filter": "frame.number == 1101",
          "timestamp_epoch": "1723680608.293826000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1103,
          "display_filter": "frame.number == 1103",
          "timestamp_epoch": "1723680608.294335000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1105,
          "display_filter": "frame.number == 1105",
          "timestamp_epoch": "1723680608.294889000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1107,
          "display_filter": "frame.number == 1107",
          "timestamp_epoch": "1723680608.295392000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1109,
          "display_filter": "frame.number == 1109",
          "timestamp_epoch": "1723680608.296055000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1111,
          "display_filter": "frame.number == 1111",
          "timestamp_epoch": "1723680608.296635000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1113,
          "display_filter": "frame.number == 1113",
          "timestamp_epoch": "1723680608.297258000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1115,
          "display_filter": "frame.number == 1115",
          "timestamp_epoch": "1723680608.297744000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1117,
          "display_filter": "frame.number == 1117",
          "timestamp_epoch": "1723680608.298252000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1119,
          "display_filter": "frame.number == 1119",
          "timestamp_epoch": "1723680608.298712000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1121,
          "display_filter": "frame.number == 1121",
          "timestamp_epoch": "1723680608.299161000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1123,
          "display_filter": "frame.number == 1123",
          "timestamp_epoch": "1723680608.299551000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1125,
          "display_filter": "frame.number == 1125",
          "timestamp_epoch": "1723680608.299949000"
        }
      ]
    },
    {
      "id": "identity-a1d9e1472ff63f841125e94b",
      "type": "identity",
      "label": "account: desktop-h8alzbv$",
      "value": "desktop-h8alzbv$",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.8.15.133"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 5,
          "frame_number": 151,
          "display_filter": "frame.number == 151",
          "timestamp_epoch": "1723680586.099681000"
        },
        {
          "tcp_stream": 8,
          "frame_number": 166,
          "display_filter": "frame.number == 166",
          "timestamp_epoch": "1723680586.110090000"
        },
        {
          "tcp_stream": 9,
          "frame_number": 169,
          "display_filter": "frame.number == 169",
          "timestamp_epoch": "1723680586.110373000"
        },
        {
          "tcp_stream": 9,
          "frame_number": 173,
          "display_filter": "frame.number == 173",
          "timestamp_epoch": "1723680586.111602000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 187,
          "display_filter": "frame.number == 187",
          "timestamp_epoch": "1723680586.120910000"
        },
        {
          "tcp_stream": 10,
          "frame_number": 195,
          "display_filter": "frame.number == 195",
          "timestamp_epoch": "1723680586.122161000"
        },
        {
          "tcp_stream": 13,
          "frame_number": 200,
          "display_filter": "frame.number == 200",
          "timestamp_epoch": "1723680586.122720000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 224,
          "display_filter": "frame.number == 224",
          "timestamp_epoch": "1723680586.133379000"
        },
        {
          "tcp_stream": 15,
          "frame_number": 226,
          "display_filter": "frame.number == 226",
          "timestamp_epoch": "1723680586.134061000"
        },
        {
          "tcp_stream": 14,
          "frame_number": 228,
          "display_filter": "frame.number == 228",
          "timestamp_epoch": "1723680586.134077000"
        },
        {
          "tcp_stream": 16,
          "frame_number": 231,
          "display_filter": "frame.number == 231",
          "timestamp_epoch": "1723680586.134839000"
        },
        {
          "tcp_stream": 17,
          "frame_number": 261,
          "display_filter": "frame.number == 261",
          "timestamp_epoch": "1723680586.153796000"
        },
        {
          "tcp_stream": 18,
          "frame_number": 264,
          "display_filter": "frame.number == 264",
          "timestamp_epoch": "1723680586.154217000"
        },
        {
          "tcp_stream": 23,
          "frame_number": 390,
          "display_filter": "frame.number == 390",
          "timestamp_epoch": "1723680586.347727000"
        },
        {
          "tcp_stream": 28,
          "frame_number": 493,
          "display_filter": "frame.number == 493",
          "timestamp_epoch": "1723680586.914545000"
        },
        {
          "tcp_stream": 30,
          "frame_number": 521,
          "display_filter": "frame.number == 521",
          "timestamp_epoch": "1723680586.976933000"
        },
        {
          "tcp_stream": 31,
          "frame_number": 533,
          "display_filter": "frame.number == 533",
          "timestamp_epoch": "1723680586.979822000"
        },
        {
          "tcp_stream": 41,
          "frame_number": 922,
          "display_filter": "frame.number == 922",
          "timestamp_epoch": "1723680594.933396000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 930,
          "display_filter": "frame.number == 930",
          "timestamp_epoch": "1723680594.934916000"
        },
        {
          "tcp_stream": 42,
          "frame_number": 932,
          "display_filter": "frame.number == 932",
          "timestamp_epoch": "1723680594.935625000"
        }
      ]
    },
    {
      "id": "identity-49f63ac83d3ec8fa3cb4336e",
      "type": "identity",
      "label": "account: plucero",
      "value": "plucero",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.8.15.133"
      ],
      "identity_type": "account",
      "frame_evidence": [
        {
          "tcp_stream": 44,
          "frame_number": 975,
          "display_filter": "frame.number == 975",
          "timestamp_epoch": "1723680608.106952000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 983,
          "display_filter": "frame.number == 983",
          "timestamp_epoch": "1723680608.115612000"
        },
        {
          "tcp_stream": 45,
          "frame_number": 985,
          "display_filter": "frame.number == 985",
          "timestamp_epoch": "1723680608.116435000"
        },
        {
          "tcp_stream": 46,
          "frame_number": 997,
          "display_filter": "frame.number == 997",
          "timestamp_epoch": "1723680608.118716000"
        },
        {
          "tcp_stream": 47,
          "frame_number": 1011,
          "display_filter": "frame.number == 1011",
          "timestamp_epoch": "1723680608.253051000"
        },
        {
          "tcp_stream": 50,
          "frame_number": 1059,
          "display_filter": "frame.number == 1059",
          "timestamp_epoch": "1723680608.280003000"
        },
        {
          "tcp_stream": 51,
          "frame_number": 1071,
          "display_filter": "frame.number == 1071",
          "timestamp_epoch": "1723680608.281162000"
        },
        {
          "tcp_stream": 1,
          "frame_number": 1111,
          "display_filter": "frame.number == 1111",
          "timestamp_epoch": "1723680608.296635000"
        },
        {
          "tcp_stream": 53,
          "frame_number": 1142,
          "display_filter": "frame.number == 1142",
          "timestamp_epoch": "1723680608.418138000"
        },
        {
          "tcp_stream": 153,
          "frame_number": 11648,
          "display_filter": "frame.number == 11648",
          "timestamp_epoch": "1723680795.695877000"
        }
      ]
    },
    {
      "id": "identity-b8cfb454bcd56e2760ca82cb",
      "type": "identity",
      "label": "full-name: Pierce Lucero",
      "value": "Pierce Lucero",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.8.15.133"
      ],
      "identity_type": "full-name",
      "frame_evidence": [
        {
          "tcp_stream": 1,
          "frame_number": 1111,
          "display_filter": "frame.number == 1111",
          "timestamp_epoch": "1723680608.296635000"
        }
      ]
    },
    {
      "id": "identity-a54cc6d236e20e959a716415",
      "type": "identity",
      "label": "hostname: DESKTOP-H8ALZBV",
      "value": "DESKTOP-H8ALZBV",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [
        "10.8.15.133"
      ],
      "identity_type": "hostname",
      "frame_evidence": [
        {
          "udp_stream": 0,
          "frame_number": 1,
          "display_filter": "frame.number == 1",
          "timestamp_epoch": "1723680583.804291000"
        },
        {
          "udp_stream": 0,
          "frame_number": 3,
          "display_filter": "frame.number == 3",
          "timestamp_epoch": "1723680583.815024000"
        },
        {
          "udp_stream": 0,
          "frame_number": 5,
          "display_filter": "frame.number == 5",
          "timestamp_epoch": "1723680583.827903000"
        },
        {
          "udp_stream": 6,
          "frame_number": 30,
          "display_filter": "frame.number == 30",
          "timestamp_epoch": "1723680584.241556000"
        },
        {
          "udp_stream": 6,
          "frame_number": 58,
          "display_filter": "frame.number == 58",
          "timestamp_epoch": "1723680584.988227000"
        },
        {
          "udp_stream": 6,
          "frame_number": 104,
          "display_filter": "frame.number == 104",
          "timestamp_epoch": "1723680585.739856000"
        },
        {
          "udp_stream": 6,
          "frame_number": 446,
          "display_filter": "frame.number == 446",
          "timestamp_epoch": "1723680586.500412000"
        },
        {
          "udp_stream": 6,
          "frame_number": 471,
          "display_filter": "frame.number == 471",
          "timestamp_epoch": "1723680586.644505000"
        },
        {
          "udp_stream": 6,
          "frame_number": 693,
          "display_filter": "frame.number == 693",
          "timestamp_epoch": "1723680587.408847000"
        },
        {
          "udp_stream": 6,
          "frame_number": 730,
          "display_filter": "frame.number == 730",
          "timestamp_epoch": "1723680588.173575000"
        },
        {
          "udp_stream": 6,
          "frame_number": 759,
          "display_filter": "frame.number == 759",
          "timestamp_epoch": "1723680588.933467000"
        },
        {
          "udp_stream": 18,
          "frame_number": 841,
          "display_filter": "frame.number == 841",
          "timestamp_epoch": "1723680589.743833000"
        },
        {
          "udp_stream": 18,
          "frame_number": 12013,
          "display_filter": "frame.number == 12013",
          "timestamp_epoch": "1723680827.249355000"
        },
        {
          "udp_stream": 18,
          "frame_number": 15256,
          "display_filter": "frame.number == 15256",
          "timestamp_epoch": "1723681305.542611000"
        },
        {
          "udp_stream": 18,
          "frame_number": 17047,
          "display_filter": "frame.number == 17047",
          "timestamp_epoch": "1723682026.693492000"
        }
      ]
    },
    {
      "id": "identity-84f2ba2861245fda99f1c11f",
      "type": "identity",
      "label": "netbios-group: LAFONTAINEBLEU",
      "value": "LAFONTAINEBLEU",
      "source": "deterministic-pcap-analysis",
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "ip_addresses": [],
      "identity_type": "netbios-group",
      "frame_evidence": [
        {
          "udp_stream": 6,
          "frame_number": 31,
          "display_filter": "frame.number == 31",
          "timestamp_epoch": "1723680584.242030000"
        },
        {
          "udp_stream": 6,
          "frame_number": 57,
          "display_filter": "frame.number == 57",
          "timestamp_epoch": "1723680584.988087000"
        },
        {
          "udp_stream": 6,
          "frame_number": 103,
          "display_filter": "frame.number == 103",
          "timestamp_epoch": "1723680585.739794000"
        },
        {
          "udp_stream": 6,
          "frame_number": 447,
          "display_filter": "frame.number == 447",
          "timestamp_epoch": "1723680586.500505000"
        }
      ]
    },
    {
      "id": "artifact-82693d03230b29d1a84e3e66",
      "type": "file-artifact",
      "label": "managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "sha256": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 2767804,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-6a7013f40e98c8ac566dd3af",
      "type": "file-artifact",
      "label": "0f60a3e7baecf2748b1c8183ed37d1e4",
      "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "sha256": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 159232,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7dda5d6d20ead492a77e1269",
      "type": "file-artifact",
      "label": "%2f(3)",
      "value": "261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594",
      "sha256": "261daf6d8ef4a2ea145dbcd589a3808af3d734af40319248dbf81746bab0f594",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 305148,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4dfb6619d91e00def004f454",
      "type": "file-artifact",
      "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(3)",
      "value": "8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47",
      "sha256": "8fcd6135214262cc9ef17efb67055b2a1baa9036a22325d8679192683c025e47",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 108543,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bcfbe9fa1545669101eac2ec",
      "type": "file-artifact",
      "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(2)",
      "value": "6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c",
      "sha256": "6a42906135e357167d748aee9f36cb40bf5ba4584e85e7e1df4433ee8f38680c",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 29990,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-8991c11376e0ba833b381a71",
      "type": "file-artifact",
      "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d",
      "value": "f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332",
      "sha256": "f8313d5ec5090e37e52eef9455de8085810a8362db2e1226f3dc42f747651332",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 18882,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-92eb79afacf5e470bf9e792d",
      "type": "file-artifact",
      "label": "f37dd878-a1b9-4f21-a8c9-65c3dd00f7a6%3fP1=1724225867&P2=404&P3=2&P4=IaxXE3ikzdIKvQz1E1qPcLRRfyHtwqWgjE0YDO8CsvKt6Jcq94KnSHhjEOc1Vkk62%2budS1LrVl%2btTvm0Hctz%2bA%3d%3d(1)",
      "value": "be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252",
      "sha256": "be2882b8c36a2a65594e72f3cedb87b34523d2a8b13e23e902c4cd952a0a4252",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 13809,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-bd2ce25940d789b12c4f79b2",
      "type": "file-artifact",
      "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(3)",
      "value": "9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499",
      "sha256": "9579dca191a7420bab906998ffd624709de7deda27481b53f6da693765f03499",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 7930,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-a14e0ced8cfa4b619e58e9c0",
      "type": "file-artifact",
      "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(2)",
      "value": "41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b",
      "sha256": "41e87d5cfc89b6168dd794c2b32cdf83bff7fe164a603416d5d7d7e399109c9b",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 4630,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-81d38c4bdd1064aa87f238e6",
      "type": "file-artifact",
      "label": "MFQwUjBQME4wTDAJBgUrDgMCGgUABBR2JNtr0JxEvYySpbyBWaqBmealCgQUzhUWO%2BoCo6Zr2tkr%2FeWMUr56UKgCEzMAPnPpacmgFoSqVQMAAAA%2Bc%2Bk%3D",
      "value": "2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6",
      "sha256": "2ba81673f8cd827df283ad30f52bcaa0514fc065fef4398dafed3a0f612517f6",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1782,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-f418088b932533b9c4c671a5",
      "type": "file-artifact",
      "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d(1)",
      "value": "0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2",
      "sha256": "0078330840159b7adc1ec144a36905642a0469d68c4879febf76dbda26ffd5b2",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1340,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-3f7eb057f5f252ca76a8f5c6",
      "type": "file-artifact",
      "label": "8f2381c2-652d-48a2-86f6-19cb7757f5dc%3fP1=1724113284&P2=404&P3=2&P4=QwGPFdJVa%2bBw71q1beBnqYWdAtr86AnZ79l2%2fNOX9l1PkiMLSVObKUK4QmaPqxVAgCpCljWyTVtZO9mpmuJNlQ%3d%3d",
      "value": "c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110",
      "sha256": "c54e6bd06d5c09a075e274a55c6d3ce31a2fabebbea38ce7083a9ebb7034a110",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 1120,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-415191c3d61d03eda7d9cf81",
      "type": "file-artifact",
      "label": "%2f(5)",
      "value": "f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64",
      "sha256": "f300d3238190768cae396cbc02636955abc1d8d2a1d9cf2b27bbd1a4d691ea64",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 732,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-1bd046466e9506632d63e0e7",
      "type": "file-artifact",
      "label": "%2f(1)",
      "value": "5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4",
      "sha256": "5e4b21db2742377a82d65f7553eb8d183f781a561ff60f9421baee33b743fac4",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 124,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-7893654ab9f44cdf7b6acf5a",
      "type": "file-artifact",
      "label": "%2f(10)",
      "value": "f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e",
      "sha256": "f394b14f8fb0b1d746f13e2acb5921e4c5962984836c1187147e341fcb693b0e",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 94,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-ea74cc4689a1cabb5f8fc9a3",
      "type": "file-artifact",
      "label": "%2f",
      "value": "dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123",
      "sha256": "dff7255b90139fbc8d3e76f31b480e65fc3eb7f49f70e7876cfb3f1cb56e5123",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 32,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "application/octet-stream"
    },
    {
      "id": "artifact-4cb50240de9ae0db273327a9",
      "type": "file-artifact",
      "label": "connecttest.txt",
      "value": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61",
      "sha256": "5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 22,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/plain"
    },
    {
      "id": "artifact-f191a5f8018208969dce50f8",
      "type": "file-artifact",
      "label": "ProcessMAU.txt",
      "value": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820",
      "sha256": "69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820",
      "source": "deterministic-pcap-analysis",
      "size_bytes": 4,
      "source_ref": "2024-08-15-traffic-analysis-exercise.pcap",
      "analysis_id": "b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "source_refs": [
        "2024-08-15-traffic-analysis-exercise.pcap",
        "deterministic-pcap-analysis"
      ],
      "content_type": "text/plain"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "type": "ioc-investigation",
      "label": "104.21.55.70",
      "value": "104.21.55.70",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "0 engines marked malicious and 1 suspicious; 53 harmless, 35 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 29 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found 8 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "not_found",
          "summary": "GreyNoise classification: unknown."
        },
        {
          "source": "abuseipdb",
          "status": "ok",
          "summary": "AbuseIPDB confidence score: 0/100."
        },
        {
          "source": "shodan",
          "status": "ok",
          "summary": "Shodan returned 13 open port(s)."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys host lookup returned 13 service(s)."
        }
      ],
      "summary": "104.21.55.70 was classified as ip. Investigation verdict is highly suspicious with score 100/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation"
      ],
      "artifact_type": "ip",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 100,
      "actor_lead_count": 0,
      "graph_edge_count": 137,
      "graph_node_count": 132,
      "source_analysis_ref": "/api/ioc/investigations/5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "graph_preview_truncated": true,
      "graph_preview_edge_count": 120,
      "graph_preview_node_count": 120
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "kind": "artifact",
      "tier": 0,
      "type": "ip",
      "value": "104.21.55.70",
      "sources": [
        "input",
        "otx",
        "urlscan",
        "abuseipdb",
        "shodan",
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:HIVE",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "HIVE",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:HIVE           (Pulse created by RVS_i_am)",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "HIVE           (Pulse created by RVS_i_am)",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:IOC Records Provided by @NextRayAI",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC Records Provided by @NextRayAI",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:IOC Records →Provided by @NextRayAI",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC Records →Provided by @NextRayAI",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:IOCs Industriales",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOCs Industriales",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:00034246.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "00034246.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:01.wdianyingwang.fenzibao.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "01.wdianyingwang.fenzibao.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:01bohj.vip",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "01bohj.vip",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:027citys.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "027citys.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:030663.compute.systalyze.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "030663.compute.systalyze.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:04se.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "04se.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:06o.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "06o.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0bc.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0bc.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0d.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0d.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0fj.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0fj.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0fxfh.oscarquinto.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0fxfh.oscarquinto.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0hcl.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0hcl.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0l.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0l.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0mu1.gyo6.kr",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0mu1.gyo6.kr",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0xchat.cresign.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0xchat.cresign.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:108eldridge.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "108eldridge.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:10onlinecasinos.org",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "10onlinecasinos.org",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:123.421148494.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "123.421148494.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:14d.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "14d.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:168abcd123.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "168abcd123.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:198381.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "198381.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:19930614.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "19930614.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1h.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1h.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1i.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1i.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1nh.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1nh.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1p5u.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1p5u.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1qu.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1qu.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1rl.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1rl.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1sa.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1sa.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1v1-lol.fr",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1v1-lol.fr",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1xbet-faq3.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1xbet-faq3.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:20141128.rex-yan-c85.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "20141128.rex-yan-c85.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:20240821.rex-yan-c85.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "20240821.rex-yan-c85.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2025happy1k.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2025happy1k.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:25471.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "25471.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2639iqjkl.de",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2639iqjkl.de",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:27rrcomo.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "27rrcomo.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:28jn.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "28jn.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:28t.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "28t.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2ez.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2ez.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2jg.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2jg.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2leaf.aogr.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2leaf.aogr.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2nb.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2nb.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2wk.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2wk.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2x.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2x.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2yr.makingmemad.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2yr.makingmemad.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:30music.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "30music.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:321distributors.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "321distributors.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:34rtpperi4d.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "34rtpperi4d.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:35.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "35.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3917332.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3917332.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3999bid.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3999bid.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3ctd.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3ctd.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3d-map.psiegel.org",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3d-map.psiegel.org",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3dbuilderapp.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3dbuilderapp.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3eu.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3eu.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3hq.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3hq.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3jq.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3jq.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3ksw.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3ksw.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3s.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3s.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3xbs.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3xbs.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3y2.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3y2.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:460ms28.tiweve1264.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "460ms28.tiweve1264.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:48009.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "48009.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4a.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4a.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4ac.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4ac.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4dip.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4dip.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4f.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4f.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4g.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4g.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4kvj.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4kvj.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4l6.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4l6.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4mv.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4mv.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4o.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4o.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4omini.oppenai.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4omini.oppenai.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4r.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4r.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4s9216tg.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4s9216tg.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:506820924.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "506820924.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:51kankanwang.fenzibao.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "51kankanwang.fenzibao.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:51v.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "51v.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:52226888.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "52226888.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:55971.cn",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "55971.cn",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:578391.compute.staging.systalyze.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "578391.compute.staging.systalyze.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:597776.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "597776.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:59ok.club",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "59ok.club",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5a7i.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5a7i.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5ad.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5ad.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5bestesingle-boersen-at.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5bestesingle-boersen-at.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5bo.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5bo.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5gbetg.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5gbetg.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5gl.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5gl.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5h6.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5h6.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5jp.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5jp.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5qb.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5qb.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5te.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5te.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5vh.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5vh.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5vss.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5vss.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:adamstrockfitness.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "adamstrockfitness.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:bankrolla.at",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "bankrolla.at",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:bolangtogel.kudajp.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "bolangtogel.kudajp.xyz",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:bonus4d.kudajp.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "bonus4d.kudajp.xyz",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:cloudflare.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "cloudflare.com",
      "sources": [
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:fascinatedbeast.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "fascinatedbeast.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:fll5w2bcqhw3q48dzyqb.kudajp.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "fll5w2bcqhw3q48dzyqb.kudajp.xyz",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:girisimiz-casibom2026.vip",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "girisimiz-casibom2026.vip",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:guidingwealth.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "guidingwealth.com",
      "sources": [
        "shodan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:thumbforgestudio.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "thumbforgestudio.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:we-barrel-pg.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "we-barrel-pg.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.8.153",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "104.21.8.153",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:172.67.170.159",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "172.67.170.159",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:url:http://fascinatedbeast.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://fascinatedbeast.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "type": "ioc-investigation",
      "label": "172.67.170.159",
      "value": "172.67.170.159",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "0 engines marked malicious and 1 suspicious; 54 harmless, 34 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 29 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 10 scan result(s). urlscan activity analysis found 8 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "not_found",
          "summary": "GreyNoise classification: unknown."
        },
        {
          "source": "abuseipdb",
          "status": "ok",
          "summary": "AbuseIPDB confidence score: 0/100."
        },
        {
          "source": "shodan",
          "status": "ok",
          "summary": "Shodan returned 13 open port(s)."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys host lookup returned 13 service(s)."
        }
      ],
      "summary": "172.67.170.159 was classified as ip. Investigation verdict is highly suspicious with score 100/100. Sources checked successfully: local-db, virustotal, otx, urlscan, abuseipdb, shodan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation"
      ],
      "artifact_type": "ip",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 100,
      "actor_lead_count": 0,
      "graph_edge_count": 144,
      "graph_node_count": 141,
      "source_analysis_ref": "/api/ioc/investigations/40c58a2f-b2de-4bff-8363-b060de19940e",
      "graph_preview_truncated": true,
      "graph_preview_edge_count": 120,
      "graph_preview_node_count": 120
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "kind": "artifact",
      "tier": 0,
      "type": "ip",
      "value": "172.67.170.159",
      "sources": [
        "input",
        "otx",
        "urlscan",
        "abuseipdb",
        "shodan",
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:HIVE",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "HIVE",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:HIVE           (Pulse created by RVS_i_am)",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "HIVE           (Pulse created by RVS_i_am)",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:IOC Records Provided by @NextRayAI",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC Records Provided by @NextRayAI",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:IOC Records →Provided by @NextRayAI",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC Records →Provided by @NextRayAI",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:IOCs Industriales",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOCs Industriales",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:00034246.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "00034246.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:01.wdianyingwang.fenzibao.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "01.wdianyingwang.fenzibao.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:01bohj.vip",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "01bohj.vip",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:027citys.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "027citys.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:030663.compute.systalyze.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "030663.compute.systalyze.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:04se.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "04se.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:06o.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "06o.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0bc.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0bc.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0d.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0d.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0fj.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0fj.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0fxfh.oscarquinto.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0fxfh.oscarquinto.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0hcl.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0hcl.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0l.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0l.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0mu1.gyo6.kr",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0mu1.gyo6.kr",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0xchat.cresign.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0xchat.cresign.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0xxwui0ue5fh4is2ndc4.kudajp.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "0xxwui0ue5fh4is2ndc4.kudajp.xyz",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:108eldridge.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "108eldridge.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:10onlinecasinos.org",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "10onlinecasinos.org",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:123.421148494.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "123.421148494.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:14d.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "14d.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:168abcd123.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "168abcd123.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:198381.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "198381.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:19930614.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "19930614.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1h.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1h.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1i.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1i.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1nh.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1nh.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1p5u.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1p5u.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1qu.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1qu.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1rl.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1rl.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1sa.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1sa.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1v1-lol.fr",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1v1-lol.fr",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1xbet-faq3.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "1xbet-faq3.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:20141128.rex-yan-c85.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "20141128.rex-yan-c85.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:20240821.rex-yan-c85.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "20240821.rex-yan-c85.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2025happy1k.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2025happy1k.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:25471.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "25471.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2639iqjkl.de",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2639iqjkl.de",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:27rrcomo.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "27rrcomo.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:28jn.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "28jn.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:28t.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "28t.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2ez.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2ez.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2jg.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2jg.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2leaf.aogr.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2leaf.aogr.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2nb.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2nb.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2wk.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2wk.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2x.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2x.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2yr.makingmemad.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "2yr.makingmemad.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:30music.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "30music.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:321distributors.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "321distributors.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:34rtpperi4d.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "34rtpperi4d.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:35.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "35.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3917332.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3917332.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3999bid.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3999bid.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3ctd.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3ctd.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3d-map.psiegel.org",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3d-map.psiegel.org",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3dbuilderapp.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3dbuilderapp.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3eu.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3eu.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3hq.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3hq.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3jq.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3jq.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3ksw.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3ksw.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3s.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3s.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3xbs.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3xbs.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3y2.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "3y2.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:460ms28.tiweve1264.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "460ms28.tiweve1264.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:48009.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "48009.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4a.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4a.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4ac.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4ac.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4dip.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4dip.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4f.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4f.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4g.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4g.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4kvj.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4kvj.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4l6.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4l6.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4mv.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4mv.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4o.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4o.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4omini.oppenai.workers.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4omini.oppenai.workers.dev",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4r.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4r.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4s9216tg.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "4s9216tg.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:506820924.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "506820924.xyz",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:51kankanwang.fenzibao.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "51kankanwang.fenzibao.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:51v.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "51v.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:52226888.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "52226888.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:55971.cn",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "55971.cn",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:578391.compute.staging.systalyze.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "578391.compute.staging.systalyze.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:597776.cc",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "597776.cc",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:59ok.club",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "59ok.club",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5a7i.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5a7i.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5ad.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5ad.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5bestesingle-boersen-at.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5bestesingle-boersen-at.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5bo.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5bo.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5gbetg.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5gbetg.com",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5gl.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5gl.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5h6.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5h6.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5jp.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5jp.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5qb.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5qb.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5te.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5te.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5vh.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5vh.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5vss.xhydh134.top",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "5vss.xhydh134.top",
      "sources": [
        "censys"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:abba1.kudajp.xyz",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "abba1.kudajp.xyz",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:bankrolla.at",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "bankrolla.at",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:cloudflare.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "cloudflare.com",
      "sources": [
        "abuseipdb"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:devtoolscenter.org",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "devtoolscenter.org",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:garlandliveoakdental.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "garlandliveoakdental.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:guidingwealth.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "guidingwealth.com",
      "sources": [
        "shodan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:intersafe.com.au",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "intersafe.com.au",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:lpages.guidingwealth.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "lpages.guidingwealth.com",
      "sources": [
        "shodan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:mucoroawofe.autos",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "mucoroawofe.autos",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:neko-eiga.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "neko-eiga.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:try-refer.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "try-refer.com",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:unibee.dev",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "unibee.dev",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:www.guidingwealth.com",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "www.guidingwealth.com",
      "sources": [
        "shodan"
      ],
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "suspicious": -1,
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "type": "ioc-investigation",
      "label": "quote.checkfedexexp.com",
      "value": "quote.checkfedexexp.com",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "14 engines marked malicious and 1 suspicious; 43 harmless, 31 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 7 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys web property lookup returned 2 record(s) for quote.checkfedexexp.com. Broader Censys search requires an organization-enabled account and API role."
        }
      ],
      "summary": "quote.checkfedexexp.com was classified as domain. Investigation verdict is needs review with score 39/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "needs review",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation"
      ],
      "artifact_type": "domain",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 39,
      "actor_lead_count": 0,
      "graph_edge_count": 19,
      "graph_node_count": 13,
      "source_analysis_ref": "/api/ioc/investigations/691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 19,
      "graph_preview_node_count": 13
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "kind": "artifact",
      "tier": 0,
      "type": "domain",
      "value": "quote.checkfedexexp.com",
      "sources": [
        "input",
        "virustotal",
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:mx1.csof.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "mx1.csof.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:mx2.csof.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "mx2.csof.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:172.67.170.159",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "172.67.170.159",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2600:1900:4001:96e:8000:1:8b56:1a5d",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2600:1900:4001:96e:8000:1:8b56:1a5d",
      "sources": [
        "virustotal",
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2606:4700:3032::6815:3746",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2606:4700:3032::6815:3746",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2606:4700:3037::ac43:aa9f",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2606:4700:3037::ac43:aa9f",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:34.41.139.193",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "34.41.139.193",
      "sources": [
        "virustotal",
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:http://quote.checkfedexexp.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://quote.checkfedexexp.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://quote.checkfedexexp.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "type": "ioc-investigation",
      "label": "business.checkfedexexp.com",
      "value": "business.checkfedexexp.com",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "13 engines marked malicious and 1 suspicious; 43 harmless, 32 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "skipped",
          "summary": "MalwareBazaar is hash-focused; input is not a hash."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 2 scan result(s). urlscan activity analysis found 1 suspicious pattern(s)."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "ok",
          "summary": "Censys web property lookup returned 2 record(s) for business.checkfedexexp.com. Broader Censys search requires an organization-enabled account and API role."
        }
      ],
      "summary": "business.checkfedexexp.com was classified as domain. Investigation verdict is suspicious with score 53/100. Sources checked successfully: local-db, virustotal, otx, urlscan, censys. Found 0 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "suspicious",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation"
      ],
      "artifact_type": "domain",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 53,
      "actor_lead_count": 0,
      "graph_edge_count": 12,
      "graph_node_count": 8,
      "source_analysis_ref": "/api/ioc/investigations/dd60fb30-9c1f-4deb-80a8-83799e126691",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 12,
      "graph_preview_node_count": 8
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "kind": "artifact",
      "tier": 0,
      "type": "domain",
      "value": "business.checkfedexexp.com",
      "sources": [
        "input",
        "virustotal",
        "urlscan",
        "censys"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:mx1.csof.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "mx1.csof.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:mx2.csof.net",
      "kind": "relationship",
      "tier": 1,
      "type": "domain",
      "value": "mx2.csof.net",
      "sources": [
        "virustotal"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:ip:2600:1900:4001:96e:8000:1:8b56:1a5d",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "2600:1900:4001:96e:8000:1:8b56:1a5d",
      "sources": [
        "virustotal",
        "urlscan"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:ip:34.41.139.193",
      "kind": "relationship",
      "tier": 1,
      "type": "ip",
      "value": "34.41.139.193",
      "sources": [
        "virustotal",
        "urlscan"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:http://business.checkfedexexp.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "http://business.checkfedexexp.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:https://business.checkfedexexp.com/",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://business.checkfedexexp.com/",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent",
      "kind": "relationship",
      "tier": 1,
      "type": "url",
      "value": "https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent",
      "sources": [
        "urlscan"
      ],
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "type": "ioc-investigation",
      "label": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "27 engines marked malicious and 0 suspicious; 0 harmless, 37 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "ok",
          "summary": "MalwareBazaar returned 1 sample record(s)."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 0 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "skipped",
          "summary": "Censys host and search pivots support IP, domain, and URL inputs."
        }
      ],
      "summary": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5 was classified as hash. Investigation verdict is suspicious with score 72/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 15 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "suspicious",
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ],
      "artifact_type": "hash",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 72,
      "actor_lead_count": 0,
      "graph_edge_count": 3,
      "graph_node_count": 3,
      "source_analysis_ref": "/api/ioc/investigations/69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 3,
      "graph_preview_node_count": 3
    },
    {
      "id": "ioc:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "type": "ioc",
      "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "source": "ioc-investigation",
      "verdict": "suspicious",
      "ioc_type": "hash",
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "description": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5 was classified as hash. Investigation verdict is suspicious with score 72/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 15 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ],
      "suspicion_score": 72
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1014",
      "type": "ttp-evidence",
      "label": "T1014 Rootkit",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1014",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1027",
      "type": "ttp-evidence",
      "label": "T1027 Obfuscated Files or Information",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1027",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1055",
      "type": "ttp-evidence",
      "label": "T1055 Process Injection",
      "source": "ioc-investigation",
      "tactic": "stealth, privilege-escalation",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1055",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1064",
      "type": "ttp-evidence",
      "label": "T1064 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1064",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1071",
      "type": "ttp-evidence",
      "label": "T1071 Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1082",
      "type": "ttp-evidence",
      "label": "T1082 System Information Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1082",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1496",
      "type": "ttp-evidence",
      "label": "T1496 Resource Hijacking",
      "source": "ioc-investigation",
      "tactic": "impact",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1496",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1518",
      "type": "ttp-evidence",
      "label": "T1518 Software Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1518",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1518.001",
      "type": "ttp-evidence",
      "label": "T1518.001 Security Software Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1518.001",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1542",
      "type": "ttp-evidence",
      "label": "T1542 Pre-OS Boot",
      "source": "ioc-investigation",
      "tactic": "stealth, persistence",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1542",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1542.003",
      "type": "ttp-evidence",
      "label": "T1542.003 Bootkit",
      "source": "ioc-investigation",
      "tactic": "stealth, persistence",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1542.003",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1564",
      "type": "ttp-evidence",
      "label": "T1564 Hide Artifacts",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1564",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1564.001",
      "type": "ttp-evidence",
      "label": "T1564.001 Hidden Files and Directories",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1564.001",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1574",
      "type": "ttp-evidence",
      "label": "T1574 Hijack Execution Flow",
      "source": "ioc-investigation",
      "tactic": "stealth, execution",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1574",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:T1574.002",
      "type": "ttp-evidence",
      "label": "T1574.002 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1574.002",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "kind": "artifact",
      "tier": 0,
      "type": "hash",
      "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "sources": [
        "input",
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "suspicious": 72,
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:180f63b858ec220fcce837e11bc1dbec",
      "kind": "relationship",
      "tier": 1,
      "type": "hash",
      "value": "180f63b858ec220fcce837e11bc1dbec",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:79f764b23b9767a10cc21b9798b233d97726b236",
      "kind": "relationship",
      "tier": 1,
      "type": "hash",
      "value": "79f764b23b9767a10cc21b9798b233d97726b236",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "type": "ioc-investigation",
      "label": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "source": "ioc-investigation",
      "sources": [
        {
          "source": "local-db",
          "status": "ok",
          "summary": "Found 0 local IOC record(s)."
        },
        {
          "source": "virustotal",
          "status": "ok",
          "summary": "58 engines marked malicious and 0 suspicious; 0 harmless, 12 undetected."
        },
        {
          "source": "threatfox",
          "status": "not_found",
          "summary": "ThreatFox returned 0 record(s)."
        },
        {
          "source": "malwarebazaar",
          "status": "ok",
          "summary": "MalwareBazaar returned 1 sample record(s)."
        },
        {
          "source": "otx",
          "status": "ok",
          "summary": "OTX returned 9 pulse(s)."
        },
        {
          "source": "urlscan",
          "status": "ok",
          "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern."
        },
        {
          "source": "greynoise",
          "status": "skipped",
          "summary": "GreyNoise is IP-focused; input is not an IP."
        },
        {
          "source": "abuseipdb",
          "status": "skipped",
          "summary": "AbuseIPDB is IP-focused; input is not an IP."
        },
        {
          "source": "shodan",
          "status": "skipped",
          "summary": "Shodan host lookup is IP-focused; input is not an IP."
        },
        {
          "source": "censys",
          "status": "skipped",
          "summary": "Censys host and search pivots support IP, domain, and URL inputs."
        }
      ],
      "summary": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6 was classified as hash. Investigation verdict is highly suspicious with score 100/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 35 ATT&CK technique lead(s) and 0 actor lead(s).",
      "verdict": "highly suspicious",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "actor_leads": [],
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ],
      "artifact_type": "hash",
      "review_status": "unreviewed-provider-context",
      "suspicion_score": 100,
      "actor_lead_count": 0,
      "graph_edge_count": 12,
      "graph_node_count": 12,
      "source_analysis_ref": "/api/ioc/investigations/f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "graph_preview_truncated": false,
      "graph_preview_edge_count": 12,
      "graph_preview_node_count": 12
    },
    {
      "id": "ioc:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "type": "ioc",
      "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "source": "ioc-investigation",
      "verdict": "highly suspicious",
      "ioc_type": "hash",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "description": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6 was classified as hash. Investigation verdict is highly suspicious with score 100/100. Sources checked successfully: local-db, virustotal, malwarebazaar, otx, urlscan. Found 35 ATT&CK technique lead(s) and 0 actor lead(s).",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ],
      "suspicion_score": 100
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1010",
      "type": "ttp-evidence",
      "label": "T1010 Application Window Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1010",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1012",
      "type": "ttp-evidence",
      "label": "T1012 Query Registry",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1012",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1027",
      "type": "ttp-evidence",
      "label": "T1027 Obfuscated Files or Information",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1027",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1033",
      "type": "ttp-evidence",
      "label": "T1033 System Owner/User Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1033",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1036",
      "type": "ttp-evidence",
      "label": "T1036 Masquerading",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1036",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1050",
      "type": "ttp-evidence",
      "label": "T1050 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1050",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1053",
      "type": "ttp-evidence",
      "label": "T1053 Scheduled Task/Job",
      "source": "ioc-investigation",
      "tactic": "execution, persistence, privilege-escalation",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1053",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1057",
      "type": "ttp-evidence",
      "label": "T1057 Process Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1057",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1060",
      "type": "ttp-evidence",
      "label": "T1060 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1060",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1063",
      "type": "ttp-evidence",
      "label": "T1063 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1063",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1070",
      "type": "ttp-evidence",
      "label": "T1070 Indicator Removal",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1070",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1070.004",
      "type": "ttp-evidence",
      "label": "T1070.004 File Deletion",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1070.004",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1071",
      "type": "ttp-evidence",
      "label": "T1071 Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1071",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1082",
      "type": "ttp-evidence",
      "label": "T1082 System Information Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1082",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1083",
      "type": "ttp-evidence",
      "label": "T1083 File and Directory Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1083",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1087",
      "type": "ttp-evidence",
      "label": "T1087 Account Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1087",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1095",
      "type": "ttp-evidence",
      "label": "T1095 Non-Application Layer Protocol",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1095",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1105",
      "type": "ttp-evidence",
      "label": "T1105 Ingress Tool Transfer",
      "source": "ioc-investigation",
      "tactic": "command-and-control",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1105",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1112",
      "type": "ttp-evidence",
      "label": "T1112 Modify Registry",
      "source": "ioc-investigation",
      "tactic": "defense-impairment, persistence",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1112",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1129",
      "type": "ttp-evidence",
      "label": "T1129 Shared Modules",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1129",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1218",
      "type": "ttp-evidence",
      "label": "T1218 System Binary Proxy Execution",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1218.010",
      "type": "ttp-evidence",
      "label": "T1218.010 Regsvr32",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof); otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218.010",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1218.011",
      "type": "ttp-evidence",
      "label": "T1218.011 Rundll32",
      "source": "ioc-investigation",
      "tactic": "stealth",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1218.011",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1497",
      "type": "ttp-evidence",
      "label": "T1497 Virtualization/Sandbox Evasion",
      "source": "ioc-investigation",
      "tactic": "stealth, discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1497",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1518",
      "type": "ttp-evidence",
      "label": "T1518 Software Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1518",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1518.001",
      "type": "ttp-evidence",
      "label": "T1518.001 Security Software Discovery",
      "source": "ioc-investigation",
      "tactic": "discovery",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1518.001",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1574",
      "type": "ttp-evidence",
      "label": "T1574 Hijack Execution Flow",
      "source": "ioc-investigation",
      "tactic": "stealth, execution",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1574",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1574.002",
      "type": "ttp-evidence",
      "label": "T1574.002 Technique lead",
      "source": "ioc-investigation",
      "tactic": "",
      "evidence": "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1574.002",
      "references": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1113",
      "type": "ttp-evidence",
      "label": "T1113 Screen Capture",
      "source": "ioc-investigation",
      "tactic": "collection",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1113",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1059.001",
      "type": "ttp-evidence",
      "label": "T1059.001 PowerShell",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1059.001",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1566",
      "type": "ttp-evidence",
      "label": "T1566 Phishing",
      "source": "ioc-investigation",
      "tactic": "initial-access",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1566",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1059.003",
      "type": "ttp-evidence",
      "label": "T1059.003 Windows Command Shell",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1059.003",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1204.001",
      "type": "ttp-evidence",
      "label": "T1204.001 Malicious Link",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1204.001",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1059",
      "type": "ttp-evidence",
      "label": "T1059 Command and Scripting Interpreter",
      "source": "ioc-investigation",
      "tactic": "execution",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1059",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ttp-evidence:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:T1553",
      "type": "ttp-evidence",
      "label": "T1553 Subvert Trust Controls",
      "source": "ioc-investigation",
      "tactic": "defense-impairment",
      "evidence": "otx (submitted indicator; provider-reported lead, not packet execution proof)",
      "attack_id": "T1553",
      "references": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "otx (submitted indicator; provider-reported lead, not packet execution proof)",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation"
      ]
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "kind": "artifact",
      "tier": 0,
      "type": "hash",
      "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "sources": [
        "input",
        "malwarebazaar",
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 100,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:EbeeOct2025 Pt1",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "EbeeOct2025 Pt1",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:IOC - WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "IOC - WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:TI Advisory No-ESAF-SOC-TI-341",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "TI Advisory No-ESAF-SOC-TI-341",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WARMCOOKIE One Year Later: New Features and FreshInsights",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "WARMCOOKIE One Year Later: New Features and FreshInsights",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WARMCOOKIE: A Technical Deep Dive into a Persistent Backdoor's Evolution.",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "WARMCOOKIE: A Technical Deep Dive into a Persistent Backdoor's Evolution.",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:Warm Cookie IOCs - 10/23/24",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "Warm Cookie IOCs - 10/23/24",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WarmCookie Malware Distributed via Malware Campaigns",
      "kind": "relationship",
      "tier": 1,
      "type": "collection",
      "value": "WarmCookie Malware Distributed via Malware Campaigns",
      "sources": [
        "otx"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:file:akdn2nefd.bin",
      "kind": "relationship",
      "tier": 1,
      "type": "file",
      "value": "akdn2nefd.bin",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:59b7b8d29252a9128536fbd08d24375f",
      "kind": "relationship",
      "tier": 1,
      "type": "hash",
      "value": "59b7b8d29252a9128536fbd08d24375f",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:7221b9125608a54f9dd706166f936c16ee23164a",
      "kind": "relationship",
      "tier": 1,
      "type": "hash",
      "value": "7221b9125608a54f9dd706166f936c16ee23164a",
      "sources": [
        "malwarebazaar"
      ],
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "suspicious": 60,
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147"
      ],
      "review_status": "unreviewed-provider-context"
    },
    {
      "id": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-a1ed7d17defaff8d5da995a8",
      "type": "pcap-observable",
      "value": "104.21.55.70",
      "ioc_type": "ipv4",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "artifact_refs": [],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 79,
          "frame_number": 6404,
          "display_filter": "frame.number == 6404",
          "timestamp_epoch": "1723680658.485902000"
        },
        {
          "udp_stream": 81,
          "frame_number": 6405,
          "display_filter": "frame.number == 6405",
          "timestamp_epoch": "1723680658.485954000"
        },
        {
          "udp_stream": 83,
          "frame_number": 6406,
          "display_filter": "frame.number == 6406",
          "timestamp_epoch": "1723680658.486039000"
        },
        {
          "udp_stream": 22,
          "frame_number": 6407,
          "display_filter": "frame.number == 6407",
          "timestamp_epoch": "1723680658.486084000"
        },
        {
          "udp_stream": 77,
          "frame_number": 6408,
          "display_filter": "frame.number == 6408",
          "timestamp_epoch": "1723680658.486173000"
        },
        {
          "udp_stream": 79,
          "frame_number": 6409,
          "display_filter": "frame.number == 6409",
          "timestamp_epoch": "1723680658.486185000"
        },
        {
          "udp_stream": 38,
          "frame_number": 9027,
          "display_filter": "frame.number == 9027",
          "timestamp_epoch": "1723680684.025067000"
        }
      ],
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_frame_count": 7,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-d01e18acf34a7126437debe3",
      "type": "pcap-observable",
      "value": "172.67.170.159",
      "ioc_type": "ipv4",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "artifact_refs": [],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 79,
          "frame_number": 6404,
          "display_filter": "frame.number == 6404",
          "timestamp_epoch": "1723680658.485902000"
        },
        {
          "udp_stream": 81,
          "frame_number": 6405,
          "display_filter": "frame.number == 6405",
          "timestamp_epoch": "1723680658.485954000"
        },
        {
          "udp_stream": 83,
          "frame_number": 6406,
          "display_filter": "frame.number == 6406",
          "timestamp_epoch": "1723680658.486039000"
        },
        {
          "udp_stream": 22,
          "frame_number": 6407,
          "display_filter": "frame.number == 6407",
          "timestamp_epoch": "1723680658.486084000"
        },
        {
          "udp_stream": 77,
          "frame_number": 6408,
          "display_filter": "frame.number == 6408",
          "timestamp_epoch": "1723680658.486173000"
        },
        {
          "udp_stream": 79,
          "frame_number": 6409,
          "display_filter": "frame.number == 6409",
          "timestamp_epoch": "1723680658.486185000"
        },
        {
          "udp_stream": 38,
          "frame_number": 9027,
          "display_filter": "frame.number == 9027",
          "timestamp_epoch": "1723680684.025067000"
        }
      ],
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_frame_count": 7,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-0695c6d0a4c2aad3939e813c",
      "type": "pcap-observable",
      "value": "quote.checkfedexexp.com",
      "ioc_type": "domain",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "artifact_refs": [],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 77,
          "frame_number": 6200,
          "display_filter": "frame.number == 6200",
          "timestamp_epoch": "1723680655.252841000"
        },
        {
          "udp_stream": 78,
          "frame_number": 6201,
          "display_filter": "frame.number == 6201",
          "timestamp_epoch": "1723680655.253474000"
        },
        {
          "udp_stream": 79,
          "frame_number": 6202,
          "display_filter": "frame.number == 6202",
          "timestamp_epoch": "1723680655.259919000"
        },
        {
          "udp_stream": 81,
          "frame_number": 6317,
          "display_filter": "frame.number == 6317",
          "timestamp_epoch": "1723680656.264200000"
        },
        {
          "udp_stream": 82,
          "frame_number": 6318,
          "display_filter": "frame.number == 6318",
          "timestamp_epoch": "1723680656.264628000"
        },
        {
          "udp_stream": 83,
          "frame_number": 6319,
          "display_filter": "frame.number == 6319",
          "timestamp_epoch": "1723680656.280145000"
        },
        {
          "udp_stream": 22,
          "frame_number": 6403,
          "display_filter": "frame.number == 6403",
          "timestamp_epoch": "1723680658.296347000"
        },
        {
          "udp_stream": 79,
          "frame_number": 6404,
          "display_filter": "frame.number == 6404",
          "timestamp_epoch": "1723680658.485902000"
        },
        {
          "udp_stream": 81,
          "frame_number": 6405,
          "display_filter": "frame.number == 6405",
          "timestamp_epoch": "1723680658.485954000"
        },
        {
          "udp_stream": 83,
          "frame_number": 6406,
          "display_filter": "frame.number == 6406",
          "timestamp_epoch": "1723680658.486039000"
        },
        {
          "udp_stream": 22,
          "frame_number": 6407,
          "display_filter": "frame.number == 6407",
          "timestamp_epoch": "1723680658.486084000"
        },
        {
          "udp_stream": 77,
          "frame_number": 6408,
          "display_filter": "frame.number == 6408",
          "timestamp_epoch": "1723680658.486173000"
        },
        {
          "udp_stream": 79,
          "frame_number": 6409,
          "display_filter": "frame.number == 6409",
          "timestamp_epoch": "1723680658.486185000"
        },
        {
          "udp_stream": 82,
          "frame_number": 6412,
          "display_filter": "frame.number == 6412",
          "timestamp_epoch": "1723680658.527301000"
        },
        {
          "udp_stream": 78,
          "frame_number": 6413,
          "display_filter": "frame.number == 6413",
          "timestamp_epoch": "1723680658.527356000"
        },
        {
          "tcp_stream": 112,
          "frame_number": 6418,
          "display_filter": "frame.number == 6418",
          "timestamp_epoch": "1723680658.536866000"
        }
      ],
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_frame_count": 16,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-557d5edf147136bd011b6bac",
      "type": "pcap-observable",
      "value": "business.checkfedexexp.com",
      "ioc_type": "domain",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "artifact_refs": [],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [
        {
          "udp_stream": 38,
          "frame_number": 9026,
          "display_filter": "frame.number == 9026",
          "timestamp_epoch": "1723680683.970135000"
        },
        {
          "udp_stream": 38,
          "frame_number": 9027,
          "display_filter": "frame.number == 9027",
          "timestamp_epoch": "1723680684.025067000"
        },
        {
          "tcp_stream": 124,
          "frame_number": 9031,
          "display_filter": "frame.number == 9031",
          "timestamp_epoch": "1723680684.086873000"
        }
      ],
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "provenance_basis": "observable-frame-evidence",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_frame_count": 3,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-3ad655436ecece548088d51c",
      "type": "pcap-observable",
      "value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "ioc_type": "sha256",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "artifact_refs": [
        {
          "sha256": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
          "filename": "managements%3f16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
          "size_bytes": 2767804,
          "artifact_id": "artifact-82693d03230b29d1a84e3e66",
          "extraction_method": "tshark-http-export-objects"
        }
      ],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [],
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "provenance_basis": "capture-exported-object; exact frame mapping unavailable",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_frame_count": 0,
      "evidence_frames_truncated": false
    },
    {
      "id": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-d3199e46bba25eff29acf803",
      "type": "pcap-observable",
      "value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "ioc_type": "sha256",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "artifact_refs": [
        {
          "sha256": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
          "filename": "0f60a3e7baecf2748b1c8183ed37d1e4",
          "size_bytes": 159232,
          "artifact_id": "artifact-6a7013f40e98c8ac566dd3af",
          "extraction_method": "tshark-http-export-objects"
        }
      ],
      "source_sha256": "e154de6895c5f0a9edd07b1279b33014507236dbb44a449790c255b87a327a3c",
      "interpretation": "observed in capture; not automatically malicious",
      "evidence_frames": [],
      "semantic_sha256": "f1e40c750b6946d0db5734f3fb390579d65b42e1dbb9cdd67b0a5c6d2f3174ab",
      "provenance_basis": "capture-exported-object; exact frame mapping unavailable",
      "source_analysis_ref": "/api/pcap/analyses/b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_frame_count": 0,
      "evidence_frames_truncated": false
    }
  ],
  "evidence_edges": [
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->collection:IOC Records Provided by @NextRayAI:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:IOC Records Provided by @NextRayAI",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "IOC Records Provided by @NextRayAI",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->collection:IOCs Industriales:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:IOCs Industriales",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "IOCs Industriales",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->collection:IOC Records →Provided by @NextRayAI:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:IOC Records →Provided by @NextRayAI",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "IOC Records →Provided by @NextRayAI",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->collection:HIVE           (Pulse created by RVS_i_am):otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:HIVE           (Pulse created by RVS_i_am)",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "HIVE           (Pulse created by RVS_i_am)",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->collection:HIVE:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:collection:HIVE",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "HIVE",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:fascinatedbeast.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:fascinatedbeast.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "fascinatedbeast.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->ip:104.21.55.70:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "104.21.55.70",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->url:http://fascinatedbeast.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:url:http://fascinatedbeast.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "http://fascinatedbeast.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:we-barrel-pg.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:we-barrel-pg.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "we-barrel-pg.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->ip:104.21.8.153:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.8.153",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "104.21.8.153",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:girisimiz-casibom2026.vip:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:girisimiz-casibom2026.vip",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "girisimiz-casibom2026.vip",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:thumbforgestudio.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:thumbforgestudio.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "thumbforgestudio.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:adamstrockfitness.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:adamstrockfitness.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "adamstrockfitness.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:fll5w2bcqhw3q48dzyqb.kudajp.xyz:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:fll5w2bcqhw3q48dzyqb.kudajp.xyz",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "fll5w2bcqhw3q48dzyqb.kudajp.xyz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:bolangtogel.kudajp.xyz:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:bolangtogel.kudajp.xyz",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "bolangtogel.kudajp.xyz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:bankrolla.at:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:bankrolla.at",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "bankrolla.at",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->ip:172.67.170.159:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:172.67.170.159",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "172.67.170.159",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:bonus4d.kudajp.xyz:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:bonus4d.kudajp.xyz",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "bonus4d.kudajp.xyz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:cloudflare.com:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:cloudflare.com",
      "evidence": "AbuseIPDB domain",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "cloudflare.com",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:guidingwealth.com:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:guidingwealth.com",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "guidingwealth.com",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:00034246.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:00034246.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "00034246.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:01.wdianyingwang.fenzibao.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:01.wdianyingwang.fenzibao.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "01.wdianyingwang.fenzibao.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:01bohj.vip:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:01bohj.vip",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "01bohj.vip",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:027citys.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:027citys.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "027citys.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:030663.compute.systalyze.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:030663.compute.systalyze.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "030663.compute.systalyze.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:04se.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:04se.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "04se.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:06o.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:06o.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "06o.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0bc.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0bc.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0bc.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0d.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0d.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0d.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0fj.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0fj.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0fj.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0fxfh.oscarquinto.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0fxfh.oscarquinto.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0fxfh.oscarquinto.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0hcl.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0hcl.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0hcl.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0l.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0l.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0l.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0mu1.gyo6.kr:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0mu1.gyo6.kr",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0mu1.gyo6.kr",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:0xchat.cresign.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:0xchat.cresign.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "0xchat.cresign.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:108eldridge.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:108eldridge.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "108eldridge.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:10onlinecasinos.org:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:10onlinecasinos.org",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "10onlinecasinos.org",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:123.421148494.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:123.421148494.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "123.421148494.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:14d.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:14d.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "14d.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:168abcd123.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:168abcd123.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "168abcd123.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:198381.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:198381.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "198381.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:19930614.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:19930614.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "19930614.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1h.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1h.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1h.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1i.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1i.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1i.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1nh.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1nh.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1nh.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1p5u.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1p5u.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1p5u.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1qu.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1qu.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1qu.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1rl.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1rl.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1rl.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1sa.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1sa.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1sa.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1v1-lol.fr:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1v1-lol.fr",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1v1-lol.fr",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:1xbet-faq3.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:1xbet-faq3.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "1xbet-faq3.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:20141128.rex-yan-c85.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:20141128.rex-yan-c85.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "20141128.rex-yan-c85.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:20240821.rex-yan-c85.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:20240821.rex-yan-c85.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "20240821.rex-yan-c85.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2025happy1k.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2025happy1k.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2025happy1k.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:25471.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:25471.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "25471.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2639iqjkl.de:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2639iqjkl.de",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2639iqjkl.de",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:27rrcomo.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:27rrcomo.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "27rrcomo.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:28jn.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:28jn.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "28jn.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:28t.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:28t.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "28t.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2ez.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2ez.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2ez.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2jg.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2jg.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2jg.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2leaf.aogr.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2leaf.aogr.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2leaf.aogr.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2nb.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2nb.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2nb.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2wk.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2wk.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2wk.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2x.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2x.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2x.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:2yr.makingmemad.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:2yr.makingmemad.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "2yr.makingmemad.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:30music.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:30music.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "30music.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:321distributors.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:321distributors.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "321distributors.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:34rtpperi4d.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:34rtpperi4d.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "34rtpperi4d.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:35.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:35.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "35.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3917332.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3917332.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3917332.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3999bid.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3999bid.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3999bid.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3ctd.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3ctd.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3ctd.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3d-map.psiegel.org:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3d-map.psiegel.org",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3d-map.psiegel.org",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3dbuilderapp.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3dbuilderapp.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3dbuilderapp.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3eu.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3eu.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3eu.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3hq.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3hq.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3hq.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3jq.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3jq.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3jq.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3ksw.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3ksw.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3ksw.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3s.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3s.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3s.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3xbs.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3xbs.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3xbs.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:3y2.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:3y2.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "3y2.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:460ms28.tiweve1264.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:460ms28.tiweve1264.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "460ms28.tiweve1264.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:48009.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:48009.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "48009.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4a.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4a.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4a.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4ac.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4ac.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4ac.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4dip.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4dip.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4dip.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4f.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4f.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4f.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4g.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4g.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4g.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4kvj.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4kvj.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4kvj.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4l6.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4l6.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4l6.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4mv.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4mv.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4mv.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4o.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4o.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4o.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4omini.oppenai.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4omini.oppenai.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4omini.oppenai.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4r.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4r.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4r.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:4s9216tg.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:4s9216tg.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "4s9216tg.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:506820924.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:506820924.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "506820924.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:51kankanwang.fenzibao.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:51kankanwang.fenzibao.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "51kankanwang.fenzibao.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:51v.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:51v.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "51v.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:52226888.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:52226888.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "52226888.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:55971.cn:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:55971.cn",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "55971.cn",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:578391.compute.staging.systalyze.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:578391.compute.staging.systalyze.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "578391.compute.staging.systalyze.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:597776.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:597776.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "597776.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:59ok.club:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:59ok.club",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "59ok.club",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5a7i.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5a7i.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5a7i.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5ad.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5ad.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5ad.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5bestesingle-boersen-at.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5bestesingle-boersen-at.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5bestesingle-boersen-at.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5bo.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5bo.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5bo.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5gbetg.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5gbetg.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5gbetg.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5gl.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5gl.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5gl.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5h6.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5h6.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5h6.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5jp.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5jp.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5jp.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5qb.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5qb.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5qb.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5te.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5te.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5te.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5vh.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5vh.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5vh.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:edge:ip:104.21.55.70->domain:5vss.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:domain:5vss.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "source_refs": [
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
        "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb:node:ip:104.21.55.70"
      ],
      "source_value": "104.21.55.70",
      "target_value": "5vss.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->collection:IOC Records Provided by @NextRayAI:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:IOC Records Provided by @NextRayAI",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "IOC Records Provided by @NextRayAI",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->collection:IOCs Industriales:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:IOCs Industriales",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "IOCs Industriales",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->collection:IOC Records →Provided by @NextRayAI:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:IOC Records →Provided by @NextRayAI",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "IOC Records →Provided by @NextRayAI",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->collection:HIVE           (Pulse created by RVS_i_am):otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:HIVE           (Pulse created by RVS_i_am)",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "HIVE           (Pulse created by RVS_i_am)",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->collection:HIVE:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:collection:HIVE",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "HIVE",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:intersafe.com.au:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:intersafe.com.au",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "intersafe.com.au",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:try-refer.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:try-refer.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "try-refer.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:bankrolla.at:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:bankrolla.at",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "bankrolla.at",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->ip:172.67.170.159:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "172.67.170.159",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:devtoolscenter.org:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:devtoolscenter.org",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "devtoolscenter.org",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:garlandliveoakdental.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:garlandliveoakdental.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "garlandliveoakdental.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:unibee.dev:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:unibee.dev",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "unibee.dev",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:mucoroawofe.autos:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:mucoroawofe.autos",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "mucoroawofe.autos",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:abba1.kudajp.xyz:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:abba1.kudajp.xyz",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "abba1.kudajp.xyz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:neko-eiga.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:neko-eiga.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "neko-eiga.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0xxwui0ue5fh4is2ndc4.kudajp.xyz:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0xxwui0ue5fh4is2ndc4.kudajp.xyz",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0xxwui0ue5fh4is2ndc4.kudajp.xyz",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:cloudflare.com:abuseipdb",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:cloudflare.com",
      "evidence": "AbuseIPDB domain",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "cloudflare.com",
      "evidence_source": "abuseipdb"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:www.guidingwealth.com:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:www.guidingwealth.com",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "www.guidingwealth.com",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:guidingwealth.com:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:guidingwealth.com",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "guidingwealth.com",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:lpages.guidingwealth.com:shodan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:lpages.guidingwealth.com",
      "evidence": "Shodan hostname",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "lpages.guidingwealth.com",
      "evidence_source": "shodan"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:00034246.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:00034246.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "00034246.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "003acdfc-546e-43c7-a327-70388d81f57c.random.25471.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "00abddd7-83bd-41e4-80c8-f39320aae190.salem-beep-beep.net",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:01.wdianyingwang.fenzibao.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:01.wdianyingwang.fenzibao.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "01.wdianyingwang.fenzibao.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:01bohj.vip:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:01bohj.vip",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "01bohj.vip",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:027citys.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:027citys.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "027citys.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:030663.compute.systalyze.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:030663.compute.systalyze.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "030663.compute.systalyze.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:04se.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:04se.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "04se.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:06o.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:06o.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "06o.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0bc.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0bc.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0bc.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0d.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0d.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0d.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0fj.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0fj.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0fj.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0fxfh.oscarquinto.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0fxfh.oscarquinto.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0fxfh.oscarquinto.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0hcl.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0hcl.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0hcl.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0l.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0l.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0l.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0mu1.gyo6.kr:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0mu1.gyo6.kr",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0mu1.gyo6.kr",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:0xchat.cresign.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:0xchat.cresign.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "0xchat.cresign.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:108eldridge.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:108eldridge.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "108eldridge.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:10onlinecasinos.org:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:10onlinecasinos.org",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "10onlinecasinos.org",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:123.421148494.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:123.421148494.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "123.421148494.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:14d.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:14d.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "14d.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:168abcd123.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:168abcd123.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "168abcd123.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:198381.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:198381.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "198381.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:19930614.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:19930614.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "19930614.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1h.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1h.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1h.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1i.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1i.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1i.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1nh.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1nh.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1nh.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1p5u.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1p5u.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1p5u.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1qu.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1qu.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1qu.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1rl.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1rl.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1rl.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1sa.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1sa.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1sa.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1v1-lol.fr:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1v1-lol.fr",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1v1-lol.fr",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:1xbet-faq3.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:1xbet-faq3.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "1xbet-faq3.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:20141128.rex-yan-c85.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:20141128.rex-yan-c85.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "20141128.rex-yan-c85.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:20240821.rex-yan-c85.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:20240821.rex-yan-c85.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "20240821.rex-yan-c85.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2025happy1k.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2025happy1k.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2025happy1k.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "23404e5a-444e-4fde-bdd1-c206351bca0b.walmartdrive-in.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:25471.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:25471.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "25471.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2639iqjkl.de:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2639iqjkl.de",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2639iqjkl.de",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "273d01d3-355a-4ea1-9989-60cdd9ddd336.salem-beep-beep.net",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:27rrcomo.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:27rrcomo.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "27rrcomo.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:28jn.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:28jn.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "28jn.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:28t.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:28t.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "28t.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2ez.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2ez.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2ez.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2jg.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2jg.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2jg.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2leaf.aogr.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2leaf.aogr.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2leaf.aogr.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2nb.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2nb.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2nb.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2wk.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2wk.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2wk.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2x.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2x.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2x.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:2yr.makingmemad.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:2yr.makingmemad.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "2yr.makingmemad.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:30music.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:30music.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "30music.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:321distributors.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:321distributors.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "321distributors.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:34rtpperi4d.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:34rtpperi4d.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "34rtpperi4d.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:35.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:35.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "35.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3917332.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3917332.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3917332.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3999bid.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3999bid.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3999bid.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3ctd.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3ctd.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3ctd.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3d-map.psiegel.org:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3d-map.psiegel.org",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3d-map.psiegel.org",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3dbuilderapp.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3dbuilderapp.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3dbuilderapp.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3eu.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3eu.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3eu.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3hq.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3hq.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3hq.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3jq.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3jq.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3jq.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3ksw.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3ksw.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3ksw.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3s.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3s.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3s.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3xbs.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3xbs.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3xbs.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:3y2.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:3y2.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "3y2.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:460ms28.tiweve1264.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:460ms28.tiweve1264.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "460ms28.tiweve1264.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:48009.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:48009.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "48009.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4a.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4a.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4a.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4ac.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4ac.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4ac.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4dip.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4dip.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4dip.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4f.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4f.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4f.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4g.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4g.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4g.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4kvj.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4kvj.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4kvj.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4l6.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4l6.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4l6.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4mv.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4mv.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4mv.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4o.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4o.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4o.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4omini.oppenai.workers.dev:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4omini.oppenai.workers.dev",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4omini.oppenai.workers.dev",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4r.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4r.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4r.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:4s9216tg.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:4s9216tg.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "4s9216tg.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:506820924.xyz:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:506820924.xyz",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "506820924.xyz",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:51kankanwang.fenzibao.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:51kankanwang.fenzibao.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "51kankanwang.fenzibao.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:51v.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:51v.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "51v.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:52226888.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:52226888.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "52226888.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:55971.cn:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:55971.cn",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "55971.cn",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:578391.compute.staging.systalyze.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:578391.compute.staging.systalyze.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "578391.compute.staging.systalyze.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:597776.cc:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:597776.cc",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "597776.cc",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:59ok.club:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:59ok.club",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "59ok.club",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5a7i.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5a7i.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5a7i.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5ad.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5ad.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5ad.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5bestesingle-boersen-at.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5bestesingle-boersen-at.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5bestesingle-boersen-at.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5bo.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5bo.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5bo.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5gbetg.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5gbetg.com",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5gbetg.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5gl.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5gl.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5gl.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5h6.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5h6.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5h6.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5jp.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5jp.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5jp.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5qb.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5qb.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5qb.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5te.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5te.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5te.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5vh.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5vh.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5vh.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:edge:ip:172.67.170.159->domain:5vss.xhydh134.top:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:domain:5vss.xhydh134.top",
      "evidence": "Censys DNS name",
      "source_ref": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "source_refs": [
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
        "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e:node:ip:172.67.170.159"
      ],
      "source_value": "172.67.170.159",
      "target_value": "5vss.xhydh134.top",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->domain:mx1.csof.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:mx1.csof.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "mx1.csof.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:34.41.139.193:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:34.41.139.193",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "34.41.139.193",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:2600:1900:4001:96e:8000:1:8b56:1a5d:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->domain:mx2.csof.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:mx2.csof.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "mx2.csof.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->domain:quote.checkfedexexp.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "quote.checkfedexexp.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:2600:1900:4001:96e:8000:1:8b56:1a5d:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:https://quote.checkfedexexp.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "https://quote.checkfedexexp.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:http://quote.checkfedexexp.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:http://quote.checkfedexexp.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "http://quote.checkfedexexp.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:34.41.139.193:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:34.41.139.193",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "34.41.139.193",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:https://quote.checkfedexexp.com/:urlscan:evidence:9",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "https://quote.checkfedexexp.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "http://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:172.67.170.159:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:172.67.170.159",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "172.67.170.159",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5:urlscan:evidence:14",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:2606:4700:3032::6815:3746:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2606:4700:3032::6815:3746",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "2606:4700:3032::6815:3746",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215:urlscan:evidence:16",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:url:https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "https://quote.checkfedexexp.com/managements?16553a25e45250a41fd5&endeds=MIGpq&JStx=59bf050d37df88a9-ade43358-eaa1220b-0571422b-0f33e6aa150e86bafd0ed4&Ld=9d7502d88d752a27b1d00587309184b5a215",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->ip:2606:4700:3037::ac43:aa9f:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:ip:2606:4700:3037::ac43:aa9f",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "2606:4700:3037::ac43:aa9f",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:edge:domain:quote.checkfedexexp.com->domain:quote.checkfedexexp.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com",
      "evidence": "Censys web property hostname",
      "source_ref": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "source_refs": [
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
        "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986:node:domain:quote.checkfedexexp.com"
      ],
      "source_value": "quote.checkfedexexp.com",
      "target_value": "quote.checkfedexexp.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->domain:mx1.csof.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:mx1.csof.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "mx1.csof.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->ip:2600:1900:4001:96e:8000:1:8b56:1a5d:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:ip:2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->domain:mx2.csof.net:virustotal",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:mx2.csof.net",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "mx2.csof.net",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->ip:34.41.139.193:virustotal",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:ip:34.41.139.193",
      "evidence": "DNS record",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "34.41.139.193",
      "evidence_source": "virustotal"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->domain:business.checkfedexexp.com:urlscan",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "evidence": "urlscan page domain",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "business.checkfedexexp.com",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->ip:2600:1900:4001:96e:8000:1:8b56:1a5d:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:ip:2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "2600:1900:4001:96e:8000:1:8b56:1a5d",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->url:https://business.checkfedexexp.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:https://business.checkfedexexp.com/",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "https://business.checkfedexexp.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->url:http://business.checkfedexexp.com/:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:http://business.checkfedexexp.com/",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "http://business.checkfedexexp.com/",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->ip:34.41.139.193:urlscan",
      "tier": 1,
      "type": "ip",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:ip:34.41.139.193",
      "evidence": "urlscan page IP",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "34.41.139.193",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->url:https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent:urlscan",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent",
      "evidence": "urlscan page URL",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->url:https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent:urlscan:evidence:10",
      "tier": 1,
      "type": "url",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:url:https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent",
      "evidence": "urlscan submitted URL",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "https://business.checkfedexexp.com/data-privacy?zj=ZzqRKxVRQ&pOd=GEokiOXFwH&sourcedp=tQMQJlIo&Tfocontent",
      "evidence_source": "urlscan"
    },
    {
      "id": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:edge:domain:business.checkfedexexp.com->domain:business.checkfedexexp.com:censys",
      "tier": 1,
      "type": "domain",
      "source": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com",
      "evidence": "Censys web property hostname",
      "source_ref": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "source_refs": [
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
        "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691:node:domain:business.checkfedexexp.com"
      ],
      "source_value": "business.checkfedexexp.com",
      "target_value": "business.checkfedexexp.com",
      "evidence_source": "censys"
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:edge:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5->hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "target": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "evidence": "malwarebazaar field sha256_hash",
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5"
      ],
      "source_value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "target_value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:edge:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5->hash:79f764b23b9767a10cc21b9798b233d97726b236:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "target": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:79f764b23b9767a10cc21b9798b233d97726b236",
      "evidence": "malwarebazaar field sha1_hash",
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5"
      ],
      "source_value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "target_value": "79f764b23b9767a10cc21b9798b233d97726b236",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:edge:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5->hash:180f63b858ec220fcce837e11bc1dbec:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "target": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:180f63b858ec220fcce837e11bc1dbec",
      "evidence": "malwarebazaar field md5_hash",
      "source_ref": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "source_refs": [
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
        "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c:node:hash:798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5"
      ],
      "source_value": "798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "target_value": "180f63b858ec220fcce837e11bc1dbec",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "evidence": "malwarebazaar field sha256_hash",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->hash:7221b9125608a54f9dd706166f936c16ee23164a:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:7221b9125608a54f9dd706166f936c16ee23164a",
      "evidence": "malwarebazaar field sha1_hash",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "7221b9125608a54f9dd706166f936c16ee23164a",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->hash:59b7b8d29252a9128536fbd08d24375f:malwarebazaar",
      "tier": 1,
      "type": "hash",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:59b7b8d29252a9128536fbd08d24375f",
      "evidence": "malwarebazaar field md5_hash",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "59b7b8d29252a9128536fbd08d24375f",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->file:akdn2nefd.bin:malwarebazaar",
      "tier": 1,
      "type": "file",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:file:akdn2nefd.bin",
      "evidence": "malwarebazaar field file_name",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "akdn2nefd.bin",
      "evidence_source": "malwarebazaar"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:WARMCOOKIE One Year Later: New Features and Fresh Insights:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:IOC - WARMCOOKIE One Year Later: New Features and Fresh Insights:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:IOC - WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "IOC - WARMCOOKIE One Year Later: New Features and Fresh Insights",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:EbeeOct2025 Pt1:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:EbeeOct2025 Pt1",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "EbeeOct2025 Pt1",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:TI Advisory No-ESAF-SOC-TI-341:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:TI Advisory No-ESAF-SOC-TI-341",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "TI Advisory No-ESAF-SOC-TI-341",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:WARMCOOKIE One Year Later: New Features and FreshInsights:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WARMCOOKIE One Year Later: New Features and FreshInsights",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "WARMCOOKIE One Year Later: New Features and FreshInsights",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:WARMCOOKIE: A Technical Deep Dive into a Persistent Backdoor's Evolution.:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WARMCOOKIE: A Technical Deep Dive into a Persistent Backdoor's Evolution.",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "WARMCOOKIE: A Technical Deep Dive into a Persistent Backdoor's Evolution.",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:Warm Cookie IOCs - 10/23/24:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:Warm Cookie IOCs - 10/23/24",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "Warm Cookie IOCs - 10/23/24",
      "evidence_source": "otx"
    },
    {
      "id": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:edge:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6->collection:WarmCookie Malware Distributed via Malware Campaigns:otx",
      "tier": 1,
      "type": "collection",
      "source": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:collection:WarmCookie Malware Distributed via Malware Campaigns",
      "evidence": "OTX pulse",
      "source_ref": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "source_refs": [
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
        "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147:node:hash:b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6"
      ],
      "source_value": "b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "target_value": "WarmCookie Malware Distributed via Malware Campaigns",
      "evidence_source": "otx"
    },
    {
      "id": "packet-enrichment:pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-a1ed7d17defaff8d5da995a8:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-a1ed7d17defaff8d5da995a8",
      "target": "ioc-investigation:5a18f1ad-bf5c-44fc-bf57-26b343c5aebb",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-d01e18acf34a7126437debe3:40c58a2f-b2de-4bff-8363-b060de19940e",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-d01e18acf34a7126437debe3",
      "target": "ioc-investigation:40c58a2f-b2de-4bff-8363-b060de19940e",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-0695c6d0a4c2aad3939e813c:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-0695c6d0a4c2aad3939e813c",
      "target": "ioc-investigation:691c6ed7-fde0-4ac9-9ab8-61cb05e2d986",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-557d5edf147136bd011b6bac:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-557d5edf147136bd011b6bac",
      "target": "ioc-investigation:dd60fb30-9c1f-4deb-80a8-83799e126691",
      "evidence": "Exact normalized type/value equality; observable-frame-evidence. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-3ad655436ecece548088d51c:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-3ad655436ecece548088d51c",
      "target": "ioc-investigation:69b5e3ba-8ca6-4c05-98e9-ec0567792f3c",
      "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    },
    {
      "id": "packet-enrichment:pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-d3199e46bba25eff29acf803:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "type": "passive-enrichment-of-exact-observable",
      "source": "pcap-observable:b79032a8-d69e-4ac1-bdd4-542473fa8e3b:observable-d3199e46bba25eff29acf803",
      "target": "ioc-investigation:f5d34eb6-9ada-4b7b-8496-a5af3cd4e147",
      "evidence": "Exact normalized type/value equality; capture-exported-object; exact frame mapping unavailable. No execution or attribution inferred.",
      "source_ref": "pcap-analysis:b79032a8-d69e-4ac1-bdd4-542473fa8e3b",
      "evidence_source": "native-packet-observable-and-saved-provider-result"
    }
  ],
  "timeline": [
    {
      "at": "2026-09-19T12:50:26.861Z",
      "event": "Added Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T12:58:15.325Z",
      "event": "Added Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap",
      "source": "Log/PCAP analysis 2024-08-15-traffic-analysis-exercise.pcap",
      "actor_count": 0,
      "report_count": 0,
      "technique_count": 1
    },
    {
      "at": "2026-09-19T14:13:30.443Z",
      "event": "Added IOC investigation for 104.21.55.70",
      "source": "IOC investigation 104.21.55.70",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:13:42.935Z",
      "event": "Added IOC investigation for 172.67.170.159",
      "source": "IOC investigation 172.67.170.159",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:14:04.250Z",
      "event": "Added IOC investigation for quote.checkfedexexp.com",
      "source": "IOC investigation quote.checkfedexexp.com",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:14:15.548Z",
      "event": "Added IOC investigation for business.checkfedexexp.com",
      "source": "IOC investigation business.checkfedexexp.com",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 0
    },
    {
      "at": "2026-09-19T14:14:36.962Z",
      "event": "Added IOC investigation for 798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "source": "IOC investigation 798563fcf7600f7ef1a35996291a9dfb5f9902733404dd499e2e736ea1dc6fc5",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 15
    },
    {
      "at": "2026-09-19T14:14:58.798Z",
      "event": "Added IOC investigation for b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "source": "IOC investigation b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6",
      "actor_count": 0,
      "report_count": 1,
      "technique_count": 35
    },
    {
      "at": "2026-09-19T14:29:12.983270+00:00",
      "event": "Linked approved passive lookups to exact typed, capture-backed PCAP observables. Frames retained where available; object hashes retain capture-export provenance. All context remains unreviewed."
    }
  ],
  "created_at": "2026-09-19T12:50:22.500968+00:00",
  "updated_at": "2026-09-19T14:29:13.010296+00:00"
}