{"type":"bundle","id":"bundle--b7d0acd5-198f-5562-880c-86a9bf2b0eae","objects":[{"type":"identity","spec_version":"2.1","id":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","created":"2020-12-08T00:00:00.000Z","modified":"2020-12-08T00:00:00.000Z","name":"TweetFeed","description":"Community-sourced Threat Intelligence feed aggregating IOCs (URLs, domains, IPs, hashes) from infosec researchers on Twitter/X. Refreshed every 15 minutes.","identity_class":"organization","contact_information":"https://tweetfeed.live"},{"type":"indicator","spec_version":"2.1","id":"indicator--050bea6c-7528-5d24-8e04-c6af8a9ccd31","created":"2026-05-16T00:00:00.000Z","modified":"2026-05-16T00:00:00.000Z","valid_from":"2026-05-16T00:00:00.000Z","name":"authmail.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'authmail.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055438164307714140"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--229cf95a-8466-5eb4-9242-3ed2c9cf8be8","created":"2026-05-16T00:00:00.000Z","modified":"2026-05-16T00:00:00.000Z","valid_from":"2026-05-16T00:00:00.000Z","name":"https://authmail.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://authmail.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055438164307714140"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b886b44c-759e-503a-be6c-46f7345dff15","created":"2026-05-16T00:18:00.000Z","modified":"2026-05-16T00:18:00.000Z","valid_from":"2026-05-16T00:18:00.000Z","name":"http://101.53.233.153:53192/Mozi.m","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://101.53.233.153:53192/Mozi.m']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055442850322518455"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdb957b2-a7f2-5bf1-9264-6cac6434f6bf","created":"2026-05-16T00:18:00.000Z","modified":"2026-05-16T00:18:00.000Z","valid_from":"2026-05-16T00:18:00.000Z","name":"101.53.233.153","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '101.53.233.153']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2055442850322518455"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4594accf-200e-5c46-8bf1-5cb3e17f07db","created":"2026-05-16T02:00:00.000Z","modified":"2026-05-16T02:00:00.000Z","valid_from":"2026-05-16T02:00:00.000Z","name":"officerep-servermailservicesdeskonlines.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'officerep-servermailservicesdeskonlines.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055468312838996127"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b8c7247-a496-50a1-b1a9-709555e85cf8","created":"2026-05-16T02:00:00.000Z","modified":"2026-05-16T02:00:00.000Z","valid_from":"2026-05-16T02:00:00.000Z","name":"https://officerep-servermailservicesdeskonlines.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://officerep-servermailservicesdeskonlines.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055468312838996127"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35d95a92-8892-5c9b-ba20-3ef66f038b8d","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"e-stat.9g4icuky.shop","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.9g4icuky.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d97aa104-58a4-5d9e-adc2-99f6c71a67d1","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"https://e-stat.9g4icuky.shop/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.9g4icuky.shop/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa863942-e058-5829-9f1c-d17bf9cbdadc","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"zx2517.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zx2517.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--950e37ab-a3bd-5514-a071-4e8884974caa","created":"2026-05-16T03:11:00.000Z","modified":"2026-05-16T03:11:00.000Z","valid_from":"2026-05-16T03:11:00.000Z","name":"http://www.zx2517.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.zx2517.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2055486297008144588"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71cdef08-550b-57f6-a5ee-3abff661e28a","created":"2026-05-16T04:00:00.000Z","modified":"2026-05-16T04:00:00.000Z","valid_from":"2026-05-16T04:00:00.000Z","name":"teieperformance.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'teieperformance.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055498523454451843"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a400fb0-51c7-5448-af87-4d2c0493b756","created":"2026-05-16T04:00:00.000Z","modified":"2026-05-16T04:00:00.000Z","valid_from":"2026-05-16T04:00:00.000Z","name":"https://teieperformance.com/app/zoNbHen3ed6ga32h9wfY25","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://teieperformance.com/app/zoNbHen3ed6ga32h9wfY25']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055498523454451843"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26c82982-4959-5334-b159-1e7f0060e7a2","created":"2026-05-16T06:00:00.000Z","modified":"2026-05-16T06:00:00.000Z","valid_from":"2026-05-16T06:00:00.000Z","name":"goodghyu.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'goodghyu.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055528719167488090"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf6f1fd7-67db-5c26-b3af-50c1f328a86c","created":"2026-05-16T06:00:00.000Z","modified":"2026-05-16T06:00:00.000Z","valid_from":"2026-05-16T06:00:00.000Z","name":"https://goodghyu.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://goodghyu.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055528719167488090"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dbd989e-fbd1-5b7c-85cb-0ae6319e91c3","created":"2026-05-16T07:15:00.000Z","modified":"2026-05-16T07:15:00.000Z","valid_from":"2026-05-16T07:15:00.000Z","name":"31.7.61.61","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.7.61.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055547697864831203"}],"labels":["C2","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07b0cca2-b932-5d14-96bb-1a1a79587691","created":"2026-05-16T07:33:00.000Z","modified":"2026-05-16T07:33:00.000Z","valid_from":"2026-05-16T07:33:00.000Z","name":"e-uprava.gov-si.shop","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-uprava.gov-si.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055552087019114940"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e6646ff-6df8-5717-b0db-0fb3c1821926","created":"2026-05-16T07:33:00.000Z","modified":"2026-05-16T07:33:00.000Z","valid_from":"2026-05-16T07:33:00.000Z","name":"http://e-uprava.gov-si.shop","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e-uprava.gov-si.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055552087019114940"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a846156-29f7-5863-8619-9ebb3e9aec3d","created":"2026-05-16T08:00:00.000Z","modified":"2026-05-16T08:00:00.000Z","valid_from":"2026-05-16T08:00:00.000Z","name":"mett-amuske-olglin.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mett-amuske-olglin.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055558906462560478"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e7f39c5-cd69-5baf-8afb-0981c40a0d70","created":"2026-05-16T08:00:00.000Z","modified":"2026-05-16T08:00:00.000Z","valid_from":"2026-05-16T08:00:00.000Z","name":"http://mett-amuske-olglin.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mett-amuske-olglin.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2055558906462560478"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--166c270f-93af-512e-9dde-e31349232728","created":"2026-05-16T08:51:00.000Z","modified":"2026-05-16T08:51:00.000Z","valid_from":"2026-05-16T08:51:00.000Z","name":"169.40.135.249","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '169.40.135.249']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055571912827556070"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f980936-c95f-5970-bfcc-06281f5bf508","created":"2026-05-16T08:51:00.000Z","modified":"2026-05-16T08:51:00.000Z","valid_from":"2026-05-16T08:51:00.000Z","name":"45.13.239.144","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.13.239.144']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2055571912827556070"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-16T10:20:00.000Z","modified":"2026-05-16T10:20:00.000Z","valid_from":"2026-05-16T10:20:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2055594129216725110"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-16T10:20:00.000Z","modified":"2026-05-16T10:20:00.000Z","valid_from":"2026-05-16T10:20:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2055594129216725110"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cee4f181-cb95-5929-8a31-67ad2b39f8d4","created":"2026-05-16T11:22:00.000Z","modified":"2026-05-16T11:22:00.000Z","valid_from":"2026-05-16T11:22:00.000Z","name":"revoke-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'revoke-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055609856049000542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98481b6d-03fd-5484-a73a-0d2568c57c99","created":"2026-05-16T11:22:00.000Z","modified":"2026-05-16T11:22:00.000Z","valid_from":"2026-05-16T11:22:00.000Z","name":"http://revoke-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://revoke-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055609856049000542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea0cce6a-be79-5bbe-ab8c-eb7d221085a8","created":"2026-05-16T11:23:00.000Z","modified":"2026-05-16T11:23:00.000Z","valid_from":"2026-05-16T11:23:00.000Z","name":"info-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055610060441600465"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b032dca-6549-5a55-83e4-8e0f2281a06c","created":"2026-05-16T11:23:00.000Z","modified":"2026-05-16T11:23:00.000Z","valid_from":"2026-05-16T11:23:00.000Z","name":"http://info-thorchain.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info-thorchain.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055610060441600465"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41f9816c-3143-5d63-a649-cdfa6c806383","created":"2026-05-16T12:08:00.000Z","modified":"2026-05-16T12:08:00.000Z","valid_from":"2026-05-16T12:08:00.000Z","name":"dpdlocorn.cyou","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dpdlocorn.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055621479862002116"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c67b35-7cfa-53a4-985b-cb93c70b7e30","created":"2026-05-16T12:08:00.000Z","modified":"2026-05-16T12:08:00.000Z","valid_from":"2026-05-16T12:08:00.000Z","name":"https://www.dpdlocorn.cyou/com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.dpdlocorn.cyou/com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055621479862002116"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccba281d-84dd-5866-aa4c-59e99d0eeb8d","created":"2026-05-16T12:08:00.000Z","modified":"2026-05-16T12:08:00.000Z","valid_from":"2026-05-16T12:08:00.000Z","name":"43.133.55.35","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.133.55.35']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2055621479862002116"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2f0b416-0475-5cb1-9e19-e9a9f8501947","created":"2026-05-16T13:46:00.000Z","modified":"2026-05-16T13:46:00.000Z","valid_from":"2026-05-16T13:46:00.000Z","name":"https://github.com/acccobug/refactored-octo-invention/releases/download/v1.0.0/tax_edoc.zip","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://github.com/acccobug/refactored-octo-invention/releases/download/v1.0.0/tax_edoc.zip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055645973624336505"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--338f682e-5ed1-5be0-97a4-b521295ba26d","created":"2026-05-16T13:46:00.000Z","modified":"2026-05-16T13:46:00.000Z","valid_from":"2026-05-16T13:46:00.000Z","name":"81a2b2d2995dfa62cc137ca9374d02611e4dbcfde1fc355a231f7fac54468366","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '81a2b2d2995dfa62cc137ca9374d02611e4dbcfde1fc355a231f7fac54468366']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055645973624336505"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dde993e-5cf4-58b1-8f0c-b78f7c23729b","created":"2026-05-16T13:49:00.000Z","modified":"2026-05-16T13:49:00.000Z","valid_from":"2026-05-16T13:49:00.000Z","name":"ebec28fd7ced06e42a94319418f01fb7dc3f60a1e21821ef41d259d5ad3f2b03","description":"IOC reported by @luke92881 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ebec28fd7ced06e42a94319418f01fb7dc3f60a1e21821ef41d259d5ad3f2b03']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/luke92881/status/2055646755253895229"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e23ca45-483b-5967-9472-206585ce4f04","created":"2026-05-16T13:51:00.000Z","modified":"2026-05-16T13:51:00.000Z","valid_from":"2026-05-16T13:51:00.000Z","name":"advocat.publicvm.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'advocat.publicvm.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055647354485690522"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c355ebd8-6318-53bd-9373-ec6e1577e610","created":"2026-05-16T13:51:00.000Z","modified":"2026-05-16T13:51:00.000Z","valid_from":"2026-05-16T13:51:00.000Z","name":"http://advocat.publicvm.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://advocat.publicvm.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055647354485690522"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--727ce2e5-c166-5182-a31d-bd151f9fdfc4","created":"2026-05-16T13:51:00.000Z","modified":"2026-05-16T13:51:00.000Z","valid_from":"2026-05-16T13:51:00.000Z","name":"d7e68cc2cf439b14f9e9ef4ddbddb921b39725c8b5327e0b0b21a815751d3f85","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd7e68cc2cf439b14f9e9ef4ddbddb921b39725c8b5327e0b0b21a815751d3f85']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055647354485690522"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9358ee53-7cfa-5b18-911f-8025efbe5d98","created":"2026-05-16T13:59:00.000Z","modified":"2026-05-16T13:59:00.000Z","valid_from":"2026-05-16T13:59:00.000Z","name":"7859cf7561d4f3598700e6a30fc3527107677ae8fa9a34b72946c45834a497d1","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7859cf7561d4f3598700e6a30fc3527107677ae8fa9a34b72946c45834a497d1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2055649255088324994"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c854edc-c47c-5323-a413-59d45d1f830c","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"thtamzon.com","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'thtamzon.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682873102127156"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8293335-a664-5569-86cd-457103fff621","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"https://www.thtamzon.com","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.thtamzon.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682873102127156"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc416a9b-4270-5f23-a889-41fc5cbf2c70","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"0b5f05da8131ae03d652e2a18de554700123bd861b391eec8fc7e264dc5fcc20","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0b5f05da8131ae03d652e2a18de554700123bd861b391eec8fc7e264dc5fcc20']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682875543183778"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--94610520-0502-53b5-ba11-3bcafe30fcc3","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"8d4674d062877c3a0177b4b0deff8b344794ed58d857b98f831a3abb0b797187","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8d4674d062877c3a0177b4b0deff8b344794ed58d857b98f831a3abb0b797187']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682875543183778"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--02591bc3-1e0e-53ff-99e9-f3dc5e8d46bb","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"http://47.79.253.210","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://47.79.253.210']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5e127b3-01b4-5e3e-a519-713a28675fb4","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"http://43.165.179.173:5000","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.165.179.173:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0d3a51e-28a3-5f1a-a5ce-edbf147ca662","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"47.79.253.210","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.79.253.210']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--092b762a-57db-53b3-92e7-d177eef6cbfd","created":"2026-05-16T16:12:00.000Z","modified":"2026-05-16T16:12:00.000Z","valid_from":"2026-05-16T16:12:00.000Z","name":"43.165.179.173","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.165.179.173']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2055682878269493344"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f84483d3-5fc0-52a3-9e62-5f1f5417677f","created":"2026-05-16T16:23:00.000Z","modified":"2026-05-16T16:23:00.000Z","valid_from":"2026-05-16T16:23:00.000Z","name":"breach.st","description":"IOC reported by @bcs_erictaylor on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'breach.st']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bcs_erictaylor/status/2055685558031028679"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98a48c0c-bcf0-539c-9a96-60350d0d2cca","created":"2026-05-16T16:23:00.000Z","modified":"2026-05-16T16:23:00.000Z","valid_from":"2026-05-16T16:23:00.000Z","name":"http://breach.st","description":"IOC reported by @bcs_erictaylor on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://breach.st']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bcs_erictaylor/status/2055685558031028679"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5de1eb28-564a-5f84-a2dd-13176550e9d0","created":"2026-05-16T16:45:00.000Z","modified":"2026-05-16T16:45:00.000Z","valid_from":"2026-05-16T16:45:00.000Z","name":"3.15.0.3","description":"IOC reported by @TweetThreatNews on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '3.15.0.3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/TweetThreatNews/status/2055691017223856465"}],"labels":["Magecart"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c51b59f1-ed57-5632-ac24-26e32b28ee3f","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"noreply.gov.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'noreply.gov.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49316862-2ff2-5af9-84fc-f3d3f527a8e0","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"http://noreply.gov.ydns.eu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://noreply.gov.ydns.eu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--722bce7b-c76b-5bc1-9869-1c5cd7821201","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"http://118.194.249.36","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://118.194.249.36']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33835475-e187-5185-ad19-320eee8e1588","created":"2026-05-16T17:57:00.000Z","modified":"2026-05-16T17:57:00.000Z","valid_from":"2026-05-16T17:57:00.000Z","name":"118.194.249.36","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '118.194.249.36']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2055709288539050134"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b53bf791-3ec8-5aa4-9deb-f6a8361c6660","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"213.108.20.59","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '213.108.20.59']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709897862664367"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fb08eb1-c253-530a-b883-7bd297513616","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"58f41bfe0c041aebe1a42581097f7c4f7dfa0598405334b71d7bf42e6c53aa68","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '58f41bfe0c041aebe1a42581097f7c4f7dfa0598405334b71d7bf42e6c53aa68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709897862664367"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ca55f77-adbe-5bb0-968d-4ed25a9f3da4","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"8a8f1306418caaced8a278ee66044fe751d0da660e2c22517d78d2d54adb4902","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a8f1306418caaced8a278ee66044fe751d0da660e2c22517d78d2d54adb4902']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709897862664367"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0fa258d-e18b-562b-bd2c-eaf8245f21cb","created":"2026-05-16T18:00:00.000Z","modified":"2026-05-16T18:00:00.000Z","valid_from":"2026-05-16T18:00:00.000Z","name":"194.147.35.34","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '194.147.35.34']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2055709900723081396"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f096e7d6-6b63-5f7a-a5ba-e44c87f6b039","created":"2026-05-16T18:01:00.000Z","modified":"2026-05-16T18:01:00.000Z","valid_from":"2026-05-16T18:01:00.000Z","name":"microwaved.info","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'microwaved.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2055710224321798536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f85c1545-3fc3-5389-97cb-0cd60da00a6f","created":"2026-05-16T18:01:00.000Z","modified":"2026-05-16T18:01:00.000Z","valid_from":"2026-05-16T18:01:00.000Z","name":"http://microwaved.info","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://microwaved.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2055710224321798536"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eac43ed-5c4b-561a-a7f7-be2d3a9e0ad8","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://169.40.135.249:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://169.40.135.249:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--90c9ffe9-ed73-5b80-bcf2-c8a60a8c047c","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://191.96.94.249:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://191.96.94.249:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0cf6f4-5d65-55aa-b00c-5c958c748705","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://23.136.44.116:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://23.136.44.116:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b1048e2-3910-5376-b472-41127870818f","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://45.13.239.144:8080","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45.13.239.144:8080']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1192b11e-51f9-575c-8b56-f22cd416dec9","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://82.23.183.51:3000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://82.23.183.51:3000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8314cd2-bd0a-52aa-a6f4-62eca1a4e278","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"2pumpservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '2pumpservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--45376410-e8ca-5b90-83ff-773bf91e050e","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://2pumpservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://2pumpservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a36f95f-25d3-50f8-8761-a23ce72ebb4e","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"fatdick.pics","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fatdick.pics']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7566fae-16b4-5a57-a044-c407c97e823d","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://fatdick.pics","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fatdick.pics']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8743175a-f759-53f5-a492-2bc5dbdbe73b","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"femboyservicesapi.xyz","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'femboyservicesapi.xyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--85561535-8579-57c6-9e57-00cd6f6ca809","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://femboyservicesapi.xyz","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://femboyservicesapi.xyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6179579-6e8a-5cc2-91d5-9963dce1e6c6","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"femboyservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'femboyservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aac2f04c-37d6-5c2e-9a85-ebe5668b7498","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"http://femboyservices.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://femboyservices.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--11da56cb-853b-53f9-a446-30ac8fc7ca59","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"191.96.94.249","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '191.96.94.249']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3953a2aa-953b-5b5c-80a4-f6d0ffe091b5","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"23.136.44.116","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.136.44.116']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eaf666e-4f30-5273-8edb-ddb74e360aa0","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"45.11.229.22","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.11.229.22']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--341d7f78-c0ad-5e19-9315-629d43b7741e","created":"2026-05-16T20:07:00.000Z","modified":"2026-05-16T20:07:00.000Z","valid_from":"2026-05-16T20:07:00.000Z","name":"82.23.183.51","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '82.23.183.51']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2055741865836560751"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c331f3e-ca69-516a-a8dd-747dca80506b","created":"2026-05-16T20:13:00.000Z","modified":"2026-05-16T20:13:00.000Z","valid_from":"2026-05-16T20:13:00.000Z","name":"agenziaentrate.grillwestfrentes.com.ar","description":"IOC reported by @Slvlombardo on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'agenziaentrate.grillwestfrentes.com.ar']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Slvlombardo/status/2055743469549756779"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b39102e3-94f3-5522-bdc0-9204b0b9fbda","created":"2026-05-16T20:13:00.000Z","modified":"2026-05-16T20:13:00.000Z","valid_from":"2026-05-16T20:13:00.000Z","name":"https://agenziaentrate.grillwestfrentes.com.ar/rimborso/it/","description":"IOC reported by @Slvlombardo on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://agenziaentrate.grillwestfrentes.com.ar/rimborso/it/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Slvlombardo/status/2055743469549756779"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05d8db4c-ee50-5193-a91f-c03ccc4734a0","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"share2e32git.sbs","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'share2e32git.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5556d58-d417-50c6-af30-b0662cf2d77a","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"http://share2e32git.sbs","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://share2e32git.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--932de585-1e81-5238-9400-65cf835d0d8a","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"plombirsirni.com","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'plombirsirni.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be016282-269f-5398-8235-ca932136a071","created":"2026-05-16T20:39:00.000Z","modified":"2026-05-16T20:39:00.000Z","valid_from":"2026-05-16T20:39:00.000Z","name":"http://plombirsirni.com","description":"IOC reported by @brkalbyrk7 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://plombirsirni.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/brkalbyrk7/status/2055749987678486685"}],"labels":["ClickFix"]}]}