{"response":[{ "Event": { "id": "89", "orgc_id": "2", "org_id": "2", "date": "2017-01-16", "threat_level_id": "2", "info": "Nile Phish - attacks again Egyptian civil society", "published": true, "uuid": "587cf513-b324-485c-b65e-07298e96ca05", "attribute_count": "52", "analysis": "1", "timestamp": "1485882657", "distribution": "1", "proposal_email_lock": false, "locked": false, "publish_timestamp": "1485888588", "sharing_group_id": "0", "Org": { "id": "2", "name": "citizenlab", "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" }, "Orgc": { "id": "2", "name": "citizenlab", "uuid": "581b5fea-818c-441a-bd1d-49798e96ca05" }, "Attribute": [ { "id": "15651", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-cf24-4254-ad98-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "account-google.serveftp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15652", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-5724-4ccd-b5f0-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "aramex-shipping.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15653", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-ee60-4f45-8efb-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "device-activation.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15654", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-4e10-41de-9d5b-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "dropbox-service.serveftp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15655", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-4184-41bd-932b-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "dropbox-sign.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15656", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-d7e4-4b55-8b85-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "dropboxsupport.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15657", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-5614-4198-bfc8-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "fedex-mail.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15658", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-d37c-406e-8703-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "fedex-shipping.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15659", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-3f6c-4a59-9c2f-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "fedex-sign.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15660", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-1708-4caa-bef5-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "googledriver-sign.ddns.net", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15661", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-3604-4351-9e9e-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "googledrive-sign.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15662", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-1470-4b9e-a921-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "google-maps.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15663", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-2d08-493e-962a-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "googlesecure-serv.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15664", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-f554-4b11-b19b-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "googlesignin.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15665", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-aaf4-49c7-9028-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "googleverify-signin.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15666", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-ea9c-4be6-a936-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "mailgooglesign.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15667", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-7d08-4995-ae9d-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "myaccount.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15668", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-4754-4997-9fdc-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "secure-team.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15669", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-7ff4-4200-a7ee-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "security-myaccount.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15670", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "588778af-421c-4ab6-8fc9-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273263", "comment": "Domains used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "verification-acc.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15671", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877af7-e064-4ea8-8048-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273847", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "dropbox-verfy.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15672", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877af7-3218-42ee-ab63-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273847", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "fedex-s.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15673", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877af7-c9f8-4198-acf2-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485273847", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "watchyoutube.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15674", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-c1c4-40d8-baa5-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "verification-team.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15675", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-2fa4-43b0-9be6-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "securityteam-notify.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15676", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-fb60-4972-a691-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "secure-alert.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15677", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-9b20-4e75-a2f1-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "quota-notification.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15678", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-e2bc-4fc7-b7a0-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "notification-team.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15679", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-5d28-4361-983f-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "fedex-notification.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15680", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-acd4-4365-ac46-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "docs-mails.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15681", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-5b10-49d8-b03d-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "restricted-videos.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15682", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "58877ce3-f668-4eb1-828a-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485274339", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "dropboxnotification.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15683", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "5887a880-559c-4680-a403-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485285504", "comment": "Related phishing domain", "sharing_group_id": "0", "deleted": false, "value": "moi-gov.serveftp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15685", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "5890c466-51f8-425d-850f-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485882470", "comment": "Domain used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "activate-google.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15686", "type": "domain", "category": "Network activity", "to_ids": true, "uuid": "5890c521-f8f4-4df3-ab2c-07298e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485882657", "comment": "Domain used in the phishing attack", "sharing_group_id": "0", "deleted": false, "value": "googlemaps.servehttp.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15399", "type": "ip-dst", "category": "Network activity", "to_ids": true, "uuid": "587cfa0f-0b54-44f1-9f4c-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585487", "comment": "IPs hosting phishing websites", "sharing_group_id": "0", "deleted": false, "value": "108.61.176.96", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15400", "type": "ip-dst", "category": "Network activity", "to_ids": true, "uuid": "587cfa22-d240-4c6a-ba53-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585506", "comment": "IP hosting phishing websites", "sharing_group_id": "0", "deleted": false, "value": "104.238.191.204", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15358", "type": "ip-dst", "category": "Network activity", "to_ids": true, "uuid": "587cf53e-ee64-4e85-a4f5-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484584254", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "176.123.26.42", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15374", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-c440-4d76-886f-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "secure.policy.check@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15375", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-e780-49b3-8a72-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "aramex.shipment@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15376", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-1c68-4978-ad06-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "fedex_tracking@outlook.sa", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15377", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-5760-44c5-9a0f-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "mails.acc.noreply@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15378", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-e788-4294-bc78-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "fedex.noreply@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15379", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-b678-4509-828e-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "customerserviceonlineteam@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15380", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-cc54-41a3-81d7-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "fedexcustomers.service@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15381", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-3f30-4cd6-8821-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "elnadeem.org@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15382", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-8200-46ea-8b62-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "dropbox.noreplay@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15383", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-814c-4b68-a2ed-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "mails.noreply.verify@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15384", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-991c-4110-bbcc-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "fedex.mails.shipping@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15385", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "587cf8ac-07ac-4f31-b12a-0bbb8e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1484585132", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "dropbox.notifications.mails@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15649", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "5887755a-551c-49ca-9e41-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485272410", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "dropbox.notfication@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] }, { "id": "15650", "type": "email-src", "category": "Payload delivery", "to_ids": false, "uuid": "5887755a-4b1c-4e2a-96ac-07288e96ca05", "event_id": "89", "distribution": "5", "timestamp": "1485272410", "comment": "", "sharing_group_id": "0", "deleted": false, "value": "drive.noreply.mail@gmail.com", "SharingGroup": [ ], "ShadowAttribute": [ ] } ], "ShadowAttribute": [ ], "RelatedEvent": [ ], "Tag": [ ] } }]}