166 lines
8.3 KiB
XML
166 lines
8.3 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="587cf513-b324-485c-b65e-07298e96ca05" last-modified="2017-01-16T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
|
<short_description>Event #89</short_description>
|
|
<description>Nile Phish - attacks again Egyptian civil society</description>
|
|
<keywords />
|
|
<authored_by>citizenlab</authored_by>
|
|
<authored_date>2017-01-16T00:00:00</authored_date>
|
|
<links />
|
|
<definition>
|
|
<Indicator operator="OR" id="587cf513-b324-485c-b65e-07298e96ca05">
|
|
<IndicatorItem id="account-google.serveftp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="aramex-shipping.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="device-activation.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="dropbox-service.serveftp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="dropbox-sign.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="dropboxsupport.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="fedex-mail.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="fedex-shipping.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="fedex-sign.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="googledriver-sign.ddns.net" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="googledrive-sign.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="google-maps.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="googlesecure-serv.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="googlesignin.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="googleverify-signin.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="mailgooglesign.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="myaccount.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="secure-team.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="security-myaccount.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="verification-acc.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="dropbox-verfy.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="fedex-s.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="watchyoutube.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="verification-team.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="securityteam-notify.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="secure-alert.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="quota-notification.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="notification-team.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="fedex-notification.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="docs-mails.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="restricted-videos.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="dropboxnotification.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="moi-gov.serveftp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="activate-google.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="googlemaps.servehttp.com" condition="is">
|
|
<Context document="Network" search="Network/DNS" type="mir" />
|
|
<Content type="string"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="108.61.176.96" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="104.238.191.204" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
<IndicatorItem id="176.123.26.42" condition="is">
|
|
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
|
<Content type="IP"></Content>
|
|
</IndicatorItem>
|
|
</Indicator>
|
|
</definition>
|
|
</ioc>
|