1081 lines
34 KiB
JSON
1081 lines
34 KiB
JSON
|
{"response":[{
|
||
|
|
"Event": {
|
||
|
|
"id": "89",
|
||
|
|
"orgc_id": "2",
|
||
|
|
"org_id": "2",
|
||
|
|
"date": "2017-01-16",
|
||
|
|
"threat_level_id": "2",
|
||
|
|
"info": "Nile Phish - attacks again Egyptian civil society",
|
||
|
|
"published": true,
|
||
|
|
"uuid": "587cf513-b324-485c-b65e-07298e96ca05",
|
||
|
|
"attribute_count": "52",
|
||
|
|
"analysis": "1",
|
||
|
|
"timestamp": "1485882657",
|
||
|
|
"distribution": "1",
|
||
|
|
"proposal_email_lock": false,
|
||
|
|
"locked": false,
|
||
|
|
"publish_timestamp": "1485888588",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"Org": {
|
||
|
|
"id": "2",
|
||
|
|
"name": "citizenlab",
|
||
|
|
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
|
||
|
|
},
|
||
|
|
"Orgc": {
|
||
|
|
"id": "2",
|
||
|
|
"name": "citizenlab",
|
||
|
|
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
|
||
|
|
},
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"id": "15651",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-cf24-4254-ad98-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "account-google.serveftp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15652",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-5724-4ccd-b5f0-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "aramex-shipping.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15653",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-ee60-4f45-8efb-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "device-activation.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15654",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-4e10-41de-9d5b-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropbox-service.serveftp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15655",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-4184-41bd-932b-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropbox-sign.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15656",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-d7e4-4b55-8b85-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropboxsupport.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15657",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-5614-4198-bfc8-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex-mail.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15658",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-d37c-406e-8703-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex-shipping.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15659",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-3f6c-4a59-9c2f-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex-sign.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15660",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-1708-4caa-bef5-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "googledriver-sign.ddns.net",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15661",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-3604-4351-9e9e-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "googledrive-sign.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15662",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-1470-4b9e-a921-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "google-maps.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15663",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-2d08-493e-962a-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "googlesecure-serv.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15664",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-f554-4b11-b19b-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "googlesignin.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15665",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-aaf4-49c7-9028-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "googleverify-signin.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15666",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-ea9c-4be6-a936-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "mailgooglesign.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15667",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-7d08-4995-ae9d-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "myaccount.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15668",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-4754-4997-9fdc-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "secure-team.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15669",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-7ff4-4200-a7ee-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "security-myaccount.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15670",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "588778af-421c-4ab6-8fc9-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273263",
|
||
|
|
"comment": "Domains used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "verification-acc.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15671",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877af7-e064-4ea8-8048-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273847",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropbox-verfy.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15672",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877af7-3218-42ee-ab63-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273847",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex-s.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15673",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877af7-c9f8-4198-acf2-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485273847",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "watchyoutube.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15674",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-c1c4-40d8-baa5-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "verification-team.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15675",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-2fa4-43b0-9be6-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "securityteam-notify.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15676",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-fb60-4972-a691-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "secure-alert.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15677",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-9b20-4e75-a2f1-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "quota-notification.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15678",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-e2bc-4fc7-b7a0-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "notification-team.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15679",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-5d28-4361-983f-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex-notification.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15680",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-acd4-4365-ac46-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "docs-mails.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15681",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-5b10-49d8-b03d-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "restricted-videos.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15682",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58877ce3-f668-4eb1-828a-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485274339",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropboxnotification.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15683",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5887a880-559c-4680-a403-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485285504",
|
||
|
|
"comment": "Related phishing domain",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "moi-gov.serveftp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15685",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5890c466-51f8-425d-850f-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485882470",
|
||
|
|
"comment": "Domain used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "activate-google.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15686",
|
||
|
|
"type": "domain",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5890c521-f8f4-4df3-ab2c-07298e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485882657",
|
||
|
|
"comment": "Domain used in the phishing attack",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "googlemaps.servehttp.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15399",
|
||
|
|
"type": "ip-dst",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585487",
|
||
|
|
"comment": "IPs hosting phishing websites",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "108.61.176.96",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15400",
|
||
|
|
"type": "ip-dst",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "587cfa22-d240-4c6a-ba53-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585506",
|
||
|
|
"comment": "IP hosting phishing websites",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "104.238.191.204",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15358",
|
||
|
|
"type": "ip-dst",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "587cf53e-ee64-4e85-a4f5-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484584254",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "176.123.26.42",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15374",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-c440-4d76-886f-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "secure.policy.check@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15375",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-e780-49b3-8a72-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "aramex.shipment@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15376",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-1c68-4978-ad06-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex_tracking@outlook.sa",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15377",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-5760-44c5-9a0f-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "mails.acc.noreply@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15378",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-e788-4294-bc78-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex.noreply@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15379",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-b678-4509-828e-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "customerserviceonlineteam@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15380",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-cc54-41a3-81d7-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedexcustomers.service@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15381",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-3f30-4cd6-8821-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "elnadeem.org@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15382",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-8200-46ea-8b62-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropbox.noreplay@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15383",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-814c-4b68-a2ed-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "mails.noreply.verify@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15384",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-991c-4110-bbcc-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "fedex.mails.shipping@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15385",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "587cf8ac-07ac-4f31-b12a-0bbb8e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1484585132",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropbox.notifications.mails@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15649",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "5887755a-551c-49ca-9e41-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485272410",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "dropbox.notfication@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "15650",
|
||
|
|
"type": "email-src",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": false,
|
||
|
|
"uuid": "5887755a-4b1c-4e2a-96ac-07288e96ca05",
|
||
|
|
"event_id": "89",
|
||
|
|
"distribution": "5",
|
||
|
|
"timestamp": "1485272410",
|
||
|
|
"comment": "",
|
||
|
|
"sharing_group_id": "0",
|
||
|
|
"deleted": false,
|
||
|
|
"value": "drive.noreply.mail@gmail.com",
|
||
|
|
"SharingGroup": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
]
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"ShadowAttribute": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"RelatedEvent": [
|
||
|
|
|
||
|
|
],
|
||
|
|
"Tag": [
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}]}
|