{
  "type": "bundle",
  "id": "bundle--5e003b40-e074-460e-96f2-dbb284d43f36",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--phishdestroy-shortdot",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "name": "PhishDestroy \u2014 ShortDot Zone Investigation",
      "identity_class": "organization",
      "sectors": [
        "non-profit"
      ],
      "contact_information": "https://phishdestroy.io"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91450937-af7b-4796-bcf6-ad61f09276f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0005.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0005.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68a6e528-c44e-4b9e-86d3-59f84e7be449",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0031.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0031.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5d56773-361c-4340-8841-ae08af2d851b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0045.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0045.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88e54912-f2ab-4e44-912d-c197a060abc5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0063.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0063.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2db250bd-cb0c-4137-94f9-e71e37534209",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223a1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223a1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa718779-87d8-48cc-8afa-b5643e09933f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223a2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223a2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60ee5be4-54df-45a3-b13a-19c7abae270f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223dh1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223dh1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f3ddde8-5f42-4aad-b9a0-80f30a42409c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba347e24-5772-4843-b9c3-cb1f9c0158b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1dab0934-75d5-4807-90be-53710709aec4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef97d0c7-1289-43e8-97cd-7b50a099da13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f5583e8-6747-4de2-abd2-31ad8325f1b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0088223tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0088223tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--565d263e-42ab-4417-8400-2c82b2ec333b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 00dsudi7yqymxe1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '00dsudi7yqymxe1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d044d305-2a5b-41c7-bae0-b4230baa2984",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0115.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0115.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8bf1df2-95be-493a-9589-4178e53f8c09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 011576.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '011576.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82173cf6-edb2-46a5-997f-4824b5486e72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0151.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0151.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28db3be1-9ac6-4561-916f-3ab010173f6d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 01sbd6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '01sbd6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c44e81c5-3a41-46cc-aa62-73dd73216b7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 01t.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '01t.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1222585-eb1a-418e-a485-7af7b3ed9ecd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0200.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0200.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--204deaf3-306b-4df5-ae7e-708f1bb2061a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0202.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0202.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0be322b-b098-4340-89f8-1809df14399f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0208.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0208.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f35b29a-1b02-441f-ad80-98a1bb696fa7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0219.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0219.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2a722cf-8cb7-4092-8d44-2255828e35c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0223.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0223.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f941bf0-5423-4fb7-9145-6ec727189fd7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 023485-kwcpayment.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '023485-kwcpayment.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--815db3d0-a701-499e-97eb-1c06bc50435e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0237.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0237.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e307e0f-32f6-4f70-818b-a5e89684f889",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0256.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0256.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5f9370b-35b4-48bd-8331-5dcb83c2aae9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0264.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0264.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a3b1295-2a00-4a18-9ed0-10342f7658bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0282.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0282.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39cade0b-1c71-4a0e-9f64-279842b907ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0315.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0315.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2acd2ee8-d47a-45ff-a5fd-9da5f4ec23f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0375.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0375.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b71ae0a5-d3af-40f8-b38d-e7c77f6f76f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0388.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0388.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3b8f73b-3752-4f6d-a7f3-bc8b4aa7cac4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0392.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0392.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50f6ce4c-551a-4f04-8047-1adaa213d691",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0393.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0393.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--956dacc1-bd80-489d-a7df-8e0f685fc835",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0439.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0439.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38c3044e-e2f5-4217-81ee-07d31d1e1a06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0449.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0449.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83943871-88b8-4365-a7bd-e8b8bd402b12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0459.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0459.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fac24a8-0bf2-435c-b247-b212a0a9af4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0475.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0475.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3332d1d9-3723-4eb6-9f4e-5a700cd4a9fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0476.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0476.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a1946887-6be9-4a4f-916f-52e6d2791f14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 048813.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '048813.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e137baa2-a014-4c19-9b34-feba5cadfb63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 04le758.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '04le758.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e809b46e-82ee-40d4-b52b-ce6726fcbe92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 04wvj9y.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '04wvj9y.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5be00325-3af9-46cc-ae0d-cea72ec70d3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0529.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0529.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9a21600-22a2-421a-bf5e-184b73a5bf01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0537.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0537.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--644046c7-679f-470d-b5e4-fa97636b1f59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 053878.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '053878.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff961261-c5f6-4582-9492-da743544ba90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0541.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0541.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3806f019-8924-4a45-aa42-965862d97aa8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0556.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0556.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06afabde-c4ae-4951-94d2-e811e9dd2fca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0578.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0578.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa8253ba-721f-47b7-b23b-68496bf3b84a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 06-07u.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '06-07u.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be23039c-fa39-4c70-b172-1f2febd41466",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0603.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0603.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dba7ead1-e68c-4240-a369-8a900302309e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0620.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0620.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fbb1eee-6bac-43b9-9a21-3f1dd0ab1e4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0682.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0682.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f51fd9d-74de-4de1-a776-67fa297fbc88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0684.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0684.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af853ae3-e3b4-4394-a66d-cb7d1a1370d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0688.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0688.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23a405a8-7975-4780-a36d-5c59ecc5796f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0699.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0699.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aae6ef4f-9bf9-47c6-b5bc-d2e7757ab42f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 06o46aayci4.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '06o46aayci4.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b83580d-e40a-4111-856e-83dc7a1e9f33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 06u.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '06u.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c5b76b3-c6c4-4e9f-a9d6-2230d94f986c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0700.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0700.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--024466c5-1e1c-453d-81bf-4e93662408ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0707e.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0707e.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0010688b-fae9-40e5-a19c-28d8fffd59e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0707e.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0707e.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--986c3005-bceb-4cfe-85bb-12329d678816",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0715.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0715.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe601cbf-b4fc-48fb-acea-7b821dcdabbd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0723.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0723.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87f8838b-1548-40aa-8844-6f2f6c691fd0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0756.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0756.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c91ad1a3-105a-449b-9a43-cb4a1c0a7a93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0764.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0764.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9303c66c-ba55-47d2-99ec-3561d42eb8f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 07c.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '07c.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--454be96f-31f1-40b7-966a-629a5d79fe33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 07f.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '07f.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99f3022f-526e-4b9b-90ab-e43a046a85c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 07t.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '07t.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e507aff9-cd1f-45d4-97dd-99ed0d551f16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0802.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0802.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebf2948c-8ce5-44bc-a181-78ca5d490d0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0824.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0824.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5266eefc-d71a-4a82-a766-da06712531b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0847.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0847.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd54ef15-3e63-4bc6-8761-918a42273c3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 08470.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '08470.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--36b0cbf9-4f7f-43a5-8d5d-51db52c6a54f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 089486.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '089486.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--564041ea-8180-48ea-a501-7e19c47e753b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 08o651d.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '08o651d.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9e9b346-4126-4010-95a2-b3ecd853b383",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0910.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0910.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a18ddb8a-a074-4692-8cc3-e13220688e89",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0947.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0947.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d7cafdd-c296-45eb-aa74-e8b144a03bc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0be.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0be.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c67e97eb-822e-43f2-b883-ddc0ee755c8c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0bf.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0bf.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae302f9a-7a33-4758-93d7-ee1fa6a66289",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0edp5.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0edp5.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--babc36ee-42b3-4c55-969f-e01da3166e6c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0g1at.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0g1at.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8100b19e-f694-4f8c-8ce0-e81a8df442fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0i563a4jejj08ap.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0i563a4jejj08ap.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b138f55-7032-41f5-8896-a872f5c7f1fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0ki.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0ki.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32ca8b67-e7f9-4261-87ce-bfc3cc16e256",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0md7v.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0md7v.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdd1f924-6a79-4a17-b8b5-c04d2ffaa31f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0nv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0nv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a669bed2-ae68-4248-8702-f93a129f5fe0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0pkz7.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0pkz7.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba1cac00-6f78-4858-b673-967cb83cdc2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0qy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0qy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf478988-224e-4e5d-9699-9d7100433e53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0s4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0s4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--901a6494-f5bd-4fde-be29-ef3227f4d3c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0uu.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0uu.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4269439-9e0e-487a-8c78-8fb9733610e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0uzoq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0uzoq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21923a7a-a78f-429e-9aa2-4104eb3dd98c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0we.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0we.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48ae2190-13b1-4c3f-9607-b9ddefae481e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0z2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0z2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ea66478-a589-43ea-8a7a-4d0f384e83ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 0z6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '0z6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81b8d057-2a96-4c86-8dc5-8f8570caf5e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1057.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1057.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--360bb35e-8aea-474e-85a6-dd2226911101",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 106173.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '106173.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82a82076-bef5-4b2b-809c-0b2fe4ec562b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740bbljpewz9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740bbljpewz9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--161cbebc-7aec-423a-a97a-595958885f12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740hipqjrux8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740hipqjrux8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34786d56-543e-4918-acc3-6493ee861de7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740ibqvvlyf2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740ibqvvlyf2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e09a3ae0-d977-4951-a0a0-3d592d5bf699",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740jujmbjsd5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740jujmbjsd5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de1c4db0-d12c-4299-bc37-8137b9d413b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740seifkkgc1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740seifkkgc1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa0e84f2-6632-4327-9cd9-e96e97a69f12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740uloeheyo3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740uloeheyo3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1707905-f7ee-4a05-bcf7-42d64bb67333",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740xjnplgso0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740xjnplgso0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43389ba2-4d27-41b4-b308-730dfcf52eca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740yddabiuz7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740yddabiuz7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9d057d3-7cbf-4455-97ce-c7a828f7d90b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740yhyxfgxt4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740yhyxfgxt4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--653c1993-76de-47e4-bc8c-a6ac74901d5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 10740zgpxyjkc6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '10740zgpxyjkc6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01033c3b-fa2e-4164-b2d7-e93ff2799f59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1075.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1075.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6adf2b58-528d-42a6-a747-5aec30564b55",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404a1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404a1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39701b9a-7545-484e-adef-7dde48fcc373",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404a2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404a2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fcc3d3da-48b3-4095-8817-cdbc091b0db4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404dh1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404dh1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9867fe6a-cb39-4e77-8036-1a178b2b7762",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31bf5c68-5f32-464b-ac15-95083c7ca796",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b68977d-cc72-4d2e-b450-f34633864b5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fb9ffea-a2d9-45a5-aba2-e135cd18d5c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f10102f7-bfd2-4549-9170-9b271a90e97e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 11110404tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '11110404tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06ce89a2-df4e-43c9-bfa5-b110ca3c1a43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1130.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1130.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6ea0f04-6c95-4bc9-aad8-e5cd86b3a0be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1134.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1134.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c18b8c2-89dd-4f53-8348-9bb743cce34b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1150.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1150.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85f8c62f-9b64-40e2-8eba-a8e92bc59639",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1171.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1171.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e855dcfc-ea29-4539-a217-40f2e75664ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1198.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1198.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56987c36-2592-4f0a-b0a6-b9534a2837fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 119sp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '119sp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d213fbb-5ebb-4cca-869f-da2d5de4df15",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1208.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1208.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c4ee25b-cc2a-49c5-bea5-b6e08626b0d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1221.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1221.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a80d642-abf6-4c78-b18f-b2b3de7110ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1243567983231.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1243567983231.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4b4efef-0509-40ea-abde-68b301ed3ed2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 124545to.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '124545to.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4f11e4a-5b61-4558-b0da-1dc5b5bc7083",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 125690.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '125690.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0673cce0-fa1c-4db3-8556-b4d87eadacf9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1282.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1282.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a8fd7c4-96fb-4540-8d5c-86a7ba6444f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 131318.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '131318.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fcfba7e1-e063-488c-9b1c-3794dcffe0a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 132335.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '132335.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1c36711-e84b-4e81-9e74-96fdc6ce4004",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1328.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1328.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b29214b-d64c-4c5f-8c4e-d3f0c7092e01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 13311.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '13311.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4b40fdf-abe9-4ea5-967a-c28f82ab88f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 134fpo.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '134fpo.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff6d67ca-e420-484c-b521-b6b0078039ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 135718.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '135718.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8ada0bf-276e-4c96-ade2-2615bb6a8d70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 13578954423.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '13578954423.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3616c05-6a93-4b6d-a871-7e6e55bf445c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1363.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1363.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9271d221-989d-4fc9-9aa0-7d3aaf893309",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1389.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1389.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75f12409-9ffa-4513-98cc-4b1ac21914a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1391.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1391.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--deb1d0d7-3d89-4cda-97d4-c44e5df6ee97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1394.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1394.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46fe7b5a-a967-4125-bb13-bf0ea7f1a85a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 13a53.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '13a53.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--273d0125-fcde-40af-958f-47c4e5927e21",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 13ym8.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '13ym8.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a6c99e9-6c55-41ff-b7df-988fc468675c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1440.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1440.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4013e86e-c623-444a-96c3-94cca283d584",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1448.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1448.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ecd97f7-907e-482f-ab49-b3d462a15bce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1452.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1452.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c021e08-61cc-4370-becd-8917ffaf21cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1457.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1457.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b312563b-54f6-4740-a251-461d05af2b05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1467.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1467.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30f74ee3-0280-4413-8b82-6e8c88d92986",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1470.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1470.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e444185-af2d-43e8-801e-a424b2c67409",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1477.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1477.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--864cf230-9b75-4106-bad0-8cda78f8a269",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1491.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1491.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97df862e-f028-480f-ab7f-486fecc760c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1493.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1493.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a90d0a7-3d85-4ba2-b4c9-5451b8fa0bfe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1499.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1499.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--175f4a21-618d-49fd-900b-f4223980e25f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 14thmp7.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '14thmp7.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6f0ef00-6971-45fb-8a8a-6ee13b602c90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1513.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1513.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b9e7f91-6e77-4239-b139-233df67a71db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 153575.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '153575.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e2b0d5e-fdea-496c-b746-f409bd5ce1eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1539.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1539.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28eb60d5-f8d0-4816-8d47-8c3356d75970",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1545.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1545.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b48ce3af-f169-4041-b1af-1bbf5a904aec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 15o13c7nhkuq9nk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '15o13c7nhkuq9nk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a65f0ce-6f9c-4490-b8a8-c573a35f80c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1616.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1616.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5b7b651-c3a9-45ab-a9e1-cdf14e7a05ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1659.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1659.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bfa3b4f8-5bbf-47ef-9e62-188359237995",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1661.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1661.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--807d2c48-b7d0-4ee8-92f1-2db633a20fc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 166b6508323beb772fe0c5643e3d0eb3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '166b6508323beb772fe0c5643e3d0eb3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b270cc2-bf0e-4293-a2e5-f31528a3080e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1682.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1682.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff6954d8-bfdb-4dd0-854b-cb01818c6afc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1693.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1693.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60183fbb-4b63-4b6b-bf5b-6c2bd6f14a18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 16xmz0y.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '16xmz0y.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--243063fd-7ae6-4892-a445-1968800060aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 17017.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '17017.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6557ac6-3cec-4848-80e7-6796ca02e3d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 170283.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '170283.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab1124bf-8b1b-478a-b967-ed02c1e7ec9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1741.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1741.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf7af1d9-5f0d-42c7-99aa-f2b74ddbe677",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1743.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1743.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70d1e281-d493-419c-b1f6-36cfd3655fb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1754.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1754.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b7e7a3e-3526-4a62-9a19-d20c6e1be3b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 177616.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '177616.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6af387e-7152-4dff-b366-97bc0e36254f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1783.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1783.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9972273b-fc05-4cac-8209-d42fea2d085a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1789.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1789.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa019ed0-2950-4a59-949d-e6f260861878",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 179563.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '179563.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f1548a8-dd17-4397-88d4-be5ab7d1e9fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1838.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1838.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42871135-b543-478f-98cb-d6650a511579",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1850.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1850.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03cded18-a5b8-4549-95fe-6390aac48f81",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 185162.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '185162.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9613a754-bcb5-4349-906d-223742e64def",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1889.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1889.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05b57c66-24cf-448b-b893-697313083669",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 189876.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '189876.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c86e27e2-f326-4e3c-900e-e3518e8170c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1911.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1911.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f29a563f-cc71-4893-b69f-81ae3a1564d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1916.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1916.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ecd402c4-cc10-42bf-aeaa-dab1f2f967ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19217.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19217.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c69a3f5-b4f2-47a6-92cd-827c6b4e2f07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19218.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19218.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2541a32d-7c7b-48c0-8e00-ee1130c094b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19219.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19219.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66f5b7bf-2e1d-40be-b47c-40b2acaf3645",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19220.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19220.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c032bbe4-1430-4263-8d53-05e38c7918ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19221.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19221.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3b578fc-0c58-4d0d-a1f6-f0a89f0e3ab8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19222.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19222.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ec7411f-de91-411e-9291-f9d321594cb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19223.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19223.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e50fd523-26a8-43a2-a0ac-5a70d168697c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19224.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19224.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4b618e1-289e-4812-bf1a-9ef8518ce0e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19225.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19225.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a9b053c9-6890-411c-9b81-c6b32bdf8f9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19226.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19226.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2f95a0f-54ba-40de-893b-58900231f3d4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19227.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19227.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e76bf19-d119-4924-b45d-ee5a5e11f3e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19228.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19228.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d3d15df-5acf-4e00-aecc-183c3ea7db0d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19229.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19229.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a96ac5b2-539e-45c7-963a-ca794e2e13b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19230.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19230.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e256751d-4294-44f8-b734-317d528503c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19231.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19231.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05d75c66-2c28-40db-93dd-338ce62e4c69",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19232.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19232.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0367ab2-47df-4775-b324-77a40707bf3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19233.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19233.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9de1c8fa-aba9-4fca-8fa1-49cc344aebe0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19234.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19234.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b57c544-e686-437b-ac34-ca1ce0a58fc7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19235.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19235.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3ac32bc-abd5-445d-9427-80628a70b2bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19236.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19236.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d36b0ba-db21-41e9-8a9c-f7f1e82dfeed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19237.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19237.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--261c5e7d-454f-4129-8ae0-383e007978fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19239.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19239.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90095ffe-f8ae-4d4f-87db-8fec4e3a02bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19240.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19240.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9550352e-bd6b-41fc-899f-1dc9c0358f49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19241.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19241.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68301273-27dd-4261-8e56-1f603a84d1bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19242.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19242.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8ea7a51-fb1b-4b09-b786-a545ffc81106",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19243.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19243.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1195529d-a957-4a4f-aea6-1315d64c8a88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19244.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19244.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21cad49e-21cc-4475-bfa7-d40e763b6786",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19245.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19245.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b57ba19f-ac26-48f9-91f2-bc6b41c9b878",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19246.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19246.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e12515ac-a4c4-49a2-b57c-c4f19573ae6d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19247.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19247.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--139fc996-39af-4495-9f58-1e647846e5d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19248.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19248.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--600f7074-d9f3-47e2-8067-dacd00cd1659",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19249.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19249.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--781a7199-06a4-4fab-ad86-e684b85c4820",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19250.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19250.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c2fc356-9c5d-449f-8b51-20397b78e46a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19251.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19251.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--508d96fa-4994-4085-9c47-5f6d5f430c25",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19252.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19252.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a457e4be-93fa-44ff-bcfc-468c5d6d69ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19253.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19253.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--161bdef0-2023-4924-8eea-24fab60a5936",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19254.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19254.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d724bdbd-9fae-4197-8932-d09ebc657f93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19255.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19255.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f9ce8af-2079-430e-b610-9c8b0c281cfc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19256.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19256.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0ccc22f-c936-444a-a273-19e8744691e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19257.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19257.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f70cc94-6e37-4349-b4e8-36c40f085a12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19258.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19258.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5753971e-a2c0-4bb6-8158-a8f339a5632c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19259.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19259.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52ce91c7-4fd2-4818-8872-8532ab9efce6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19260.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19260.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93721340-f343-4c68-a871-c58dbfdb1e0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19261.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19261.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb4958fc-8aca-4244-bba6-34c6758c0cd5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19262.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19262.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f6dc4c8f-5b93-447d-a88e-3239c556b9f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19263.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19263.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--603b2b98-0a1a-408d-a9df-72407f429460",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19264.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19264.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e11b9954-e77a-4ba0-9a90-001a6e520761",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19265.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19265.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e342db6-f188-4322-b311-a74d62153f7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 19266.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '19266.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70fdbe10-19cc-4c4d-8b8b-3c54e51d2719",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1929.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1929.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc4cbbd2-3586-45b4-9847-5443cd53dd71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1933.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1933.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f0e3a31-fdbb-487a-aa5d-337229cb8ee1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1962.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1962.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85960d32-5de1-4b07-a2ff-f1f1dc2082bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 197272.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '197272.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49a2f458-3788-4dc1-ac53-c1ab94c0d6df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1am.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1am.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f46425a-d4be-47d9-ad54-e39d2f6c1117",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1bnz2i0.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1bnz2i0.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20a07f74-10c6-4f1d-97bb-b0567ff2d0f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1c5f1htu9fzkbx8j.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1c5f1htu9fzkbx8j.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc40bd89-a914-4bfe-8cb8-d19c3d5123d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1dd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1dd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22341891-5c74-4bfc-9a4b-31d1f47b04f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1dl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1dl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3414125f-3642-4ebc-8f89-2a950dcc5f7f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1en.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1en.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0a1b354-4280-4f25-9569-aac7ff966796",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1fg.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1fg.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65c3d387-4162-449a-ba5c-9c273e460e61",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1g4eomj7m5uupch.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1g4eomj7m5uupch.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae859f4e-ece7-4f93-b37f-7956413a53fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1i0wt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1i0wt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--553ca699-0aca-4b16-88a0-e6cb3e314aa4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1i94sp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1i94sp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d656bc8c-4202-4a24-9c59-293f047a11a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1l5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1l5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75892918-07b0-4576-ae22-31d8e487a657",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1lpay.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1lpay.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83503a75-b03a-407b-9a51-4f454da28fef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1n549unzn1c8etzgjeoe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1n549unzn1c8etzgjeoe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a71a258e-8e80-408b-8a53-c108d5fabf54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1nx.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1nx.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72d4d922-0d22-42be-a7b4-121cf4dd5312",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1oauf7j.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1oauf7j.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4625dc28-245d-4040-aab7-163e438a0383",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1oz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1oz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88064816-91c5-483f-bedb-75ed1bde5354",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1pc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1pc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3b2c382-b5cc-4ea4-8cbd-fd78d17d6bd0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1pd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1pd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88c06c28-e7c7-4fd6-9657-2d153d96c597",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1qn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1qn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d74e475c-daf4-4fe0-aec7-cf8abc007b75",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1qr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1qr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f5d3c66-d532-4183-ba52-ca56d97692ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1qx.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1qx.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b7d9384-85ac-47e4-881d-8b5438328481",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1rpft.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1rpft.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b55d735-6731-4ac1-be46-a55814a2a148",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1rq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1rq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef84f9e1-adea-4241-be16-b322c515c865",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1so.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1so.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea8b24bb-bb4f-4e39-921b-401a874924b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1td.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1td.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--964b9747-ae46-4e30-a784-1083cbdf1cb3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1tq1p.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1tq1p.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--764e1af3-46f7-49d8-8003-a694bdf61362",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1u7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1u7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d1ffeff-af5e-422d-b947-4d4e40bc6259",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1w2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1w2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7cccf2a-6568-498e-962b-ca7f88fe08d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1win-girislertam2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1win-girislertam2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50ee61fb-c538-4d8a-996f-1a8e74fcd7de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 1wuz53.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '1wuz53.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c2d76bc-af78-4cdb-9812-5608e99cd65f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2006.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2006.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--889b5574-9417-427f-add2-15a39f37f08b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2012.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2012.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5ba37db-606c-4e2b-8fc3-9351886e190e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2026-gir.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2026-gir.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--732e9806-8d66-4387-a6a2-d2933ec7f424",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 20543.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '20543.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1bfbe16-b111-4d4b-a948-82ec40cb8968",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2064.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2064.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d6e18da-e143-4f1a-b16b-8e0d101e88c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2089.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2089.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e38c5f6b-2247-4ec9-9c7f-5812ad29d733",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 20g625fe-i538nvzmj.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '20g625fe-i538nvzmj.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--459aa955-43e5-46f6-9637-3f2f481d09c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 20k5z.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '20k5z.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ae7d81f-3449-460b-b9a0-03d9ce831273",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 20nmewp22in1u18.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '20nmewp22in1u18.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc9320b1-6821-42c6-b423-e9566877d75d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 20xon49.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '20xon49.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6fae4589-d02c-4260-aafd-5d8d4832a7ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 21192.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '21192.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b62f3308-49e5-4ee9-8486-b7b881b7820a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2128.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2128.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99b614ee-0e29-4c90-9dc6-cc60628e0c04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2146.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2146.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42dc86ad-db71-4bdd-91e8-ea46061475f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2151.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2151.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdbd1224-536b-40f5-a393-e6107a3c0861",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 21528.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '21528.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--869fefa2-f13d-4ec0-84d4-252e12b15808",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2164.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2164.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f56aeff4-9a18-4732-9fb1-21e3be453385",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2166.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2166.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7171d11e-97b7-402c-a998-ccd4643edcfb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2170.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2170.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95f42460-fb57-4f03-9496-eff488a95e49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2181.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2181.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--262ae079-d2d2-4bce-974e-4763a9fb1984",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2182.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2182.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--adb65500-a932-4aaf-82d8-e4550eaa2e5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188a1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188a1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de3cdcb9-906e-45e9-930b-346444f41791",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188a2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188a2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54d62970-b4be-4996-8863-ef3e268e4257",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188dh1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188dh1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90e12b6c-fc9c-4413-8d24-bf54f53028c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b62b2cc-c39d-4bdd-a30b-69537bd585e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78d2f9b2-1f89-40df-91f9-a050134b9d12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44f878a3-42e0-474e-84c5-04f7bac6d2d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2a5f97e-8b0f-42df-aeef-7b6799a493f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22221188tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22221188tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3a9d40e-97f2-480c-b1f6-977a3982c26a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 225936ke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '225936ke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e3a6f9e-83f5-43eb-b1a4-12c98be24c8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2270.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2270.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0896d2f8-776e-4c25-9b3f-10898da35e07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2273.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2273.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06feb6b0-657c-46d0-9058-0c2555ae0d5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2277.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2277.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--084e1276-de31-4c48-95a0-7ffaa403d0c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2283.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2283.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b07caf5-c7af-442b-aaef-4e452a44422d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 22bbmega.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '22bbmega.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31005719-3c37-4554-9801-068fd3717f69",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2309h034h843.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2309h034h843.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a84b883-a7fa-4ded-aba2-b21537dc4346",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2342.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2342.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f6b47a5-db0e-4543-8cdd-20f1b0a21dc4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 235882k.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '235882k.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62fa6f24-8fbf-4bcf-b1cc-f02f8fb0f49f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2374.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2374.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d1617dd-8074-42ca-827d-0fd9288828f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 23uc4y.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '23uc4y.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c24da8b7-f0f3-4637-8c8c-8e8c7b18ffbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2408.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2408.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a95146f2-7902-4a23-8a5f-98756c9c2e85",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2431.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2431.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7a988ec-65a5-4db2-8513-040fb12f9dc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2437.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2437.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffbc05d5-84bf-4cf3-9c9d-02af02179c14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2444.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2444.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54dd47df-2266-4848-9130-82f9faf3f11b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2449.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2449.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4aaf9f4f-ed06-41ad-a559-b170edb15983",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2456.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2456.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af272a85-bcd7-4086-87e7-4966b031a278",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2476.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2476.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b700fbb0-80c9-48cd-baf7-a98d423e5857",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2490.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2490.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c39d936-48f8-47e1-969c-23818f335607",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 25-5v1bdqjug6s1evz.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '25-5v1bdqjug6s1evz.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57c7f931-cbad-4b4e-b4b5-3a1cbf282617",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2544.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2544.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9a0d853-d56d-4237-a993-2ba8022cae62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2546.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2546.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9522837d-d169-48d5-803b-505e9a190cf2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2560.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2560.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab0c4509-186f-402b-9782-098fb4c9fcb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2565.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2565.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b339351-76b1-49e1-9dff-1554fae570ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2570.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2570.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed0f13e6-147d-4ec9-a0e9-31856c09c7f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 259951.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '259951.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--969613b1-e894-473b-bc0c-e31b564f1951",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26541.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26541.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21dd91df-b366-4c37-8fce-1942d93ff399",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26542.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26542.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d47b7195-cc77-4f32-a265-a9947f3d9243",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26543.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26543.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1da3fb27-44d2-4c5a-96d2-174efc62abb2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26544.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26544.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1889c75-6402-4041-b44e-7dd369d3383f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26545.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26545.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c6c611d-3c86-4fe1-9f9b-16925ed06da9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26546.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26546.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a07e0162-98d4-4ab2-9078-ee2fa3ea3e46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26547.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26547.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f31e39eb-06fb-47bb-a19e-ee27a68c3d4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26550.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26550.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--457abb3f-d041-49c7-8e0e-5aefa92b8516",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26551.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26551.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--357d5bf9-c769-48c0-984d-7c564c87b0ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26552.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26552.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4631005a-8073-482a-a165-74cff966883b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26553.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26553.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--451e17b5-d14d-4dd5-82e8-d821b5026738",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26554.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26554.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d886dc72-a03e-4e69-8b7e-3a775c3ed1cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26555.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26555.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1300241d-24cb-4474-807e-13a1b85fd8fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26556.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26556.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f9af9b9-cc77-478b-a231-efa8a3f26771",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26557.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26557.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6416648-480c-450d-a003-188600937a8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26558.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26558.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4be636af-6af0-4eef-bdd6-d54aa6e74277",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26559.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26559.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--896b0fb9-d6a7-421f-b540-bef2405b32ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26562.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26562.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6543871c-478e-4a6f-b80a-bf0e32a57b71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2657.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2657.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f7ae4bb-276f-4b85-820f-34ecda51549f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26577.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26577.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16e4559e-e781-46b8-a0f4-902d3e1d17ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26578.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26578.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91f1cfe3-f281-4fe9-b1f1-372c90598305",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26579.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26579.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d8542e2-3a32-4ffa-a656-75bd244e0562",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26580.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26580.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67c6be45-fe4c-499a-bc82-937d35bb0ea3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26581.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26581.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2cd7da6-3ec5-431f-ab84-2ed930eb1998",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26583.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26583.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28adbc39-8d5c-4fa2-8113-ccbfc487ca1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26584.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26584.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89d615a3-f0f1-488d-9191-c42ded5855fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26585.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26585.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86422f9f-67f3-4b61-b508-096339a08f93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26586.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26586.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6c70383-5bf7-4b46-89f7-7fbf507a853e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26588.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26588.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d51a1b0a-0972-4b4f-a26b-4670e9faab96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26589.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26589.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42519e82-8e3a-46ca-b8f0-a91d596ec2d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26593.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26593.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f642861f-27b0-47ce-8dec-c8680d346c00",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26594.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26594.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d45d918a-88c8-45bc-9185-4b54e5bf2d1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26596.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26596.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6359bba7-189c-46fa-8946-89d2fff46b6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26598.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26598.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed5db363-7f4a-48b1-be6d-12bcfa6b849c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26600.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26600.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c4cd6d5-ca73-4e1a-9ad3-4279fd0940bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26601.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26601.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d39a545-83d4-4d6f-9576-06c3e1b8392e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26603.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26603.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73981b64-02de-4dd7-a1ff-b3637959d7c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26605.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26605.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50f396d1-3e36-4870-883d-f721598dc262",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26606.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26606.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ddbefd8-9628-4573-be39-d7a4396f72ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26607.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26607.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81691fe8-8c28-4e77-8b4a-f2e17deaad64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26608.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26608.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c77ab5b5-2955-4a29-b64d-daa7dc74207c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26609.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26609.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99361cae-ce6e-4966-be2b-86face9f5c3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26610.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26610.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f17a177-c74c-4fa2-830e-6dc4b3cf0e68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26611.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26611.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aef7141c-3ee3-48da-926d-cbf6d824e1a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 26612.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '26612.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31dc62ff-2152-4977-9c09-6fd4e0e1a773",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 266323.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '266323.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--10104563-2a07-4c2a-9237-452d55b314f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2697.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2697.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1910c189-878c-48d3-a7cc-a98fe3a14b14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2723.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2723.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9293b8d-1a94-4353-a6d2-fa2c99ba65f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2727.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2727.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68dc8135-f148-440b-a007-21bcbf96f787",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2739.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2739.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73ec42ca-e9de-43f5-8525-c0e3a82cf4e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 277852.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '277852.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b74380e-fbf5-473d-8ea3-53f72a095b77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2781.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2781.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f0e40d9-3efa-4ea3-b224-1cd24da85065",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2792.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2792.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67fc84bc-415a-42a3-8781-dfd7b2489fab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2794.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2794.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9d2586a-f9c5-4d56-a415-9bdf7414bbbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2811.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2811.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c557cef3-d857-4a0d-8d67-28beb5baffd6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2850.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2850.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--297268eb-3efa-4a22-9fec-82006f36d5cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2861.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2861.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0866c449-0145-4699-8cd3-62c916d817bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2913.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2913.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1ae8643-580c-4301-8c3e-e150314a854b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2946.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2946.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcd0d70c-2ab2-41ab-a20e-f573bae05cc0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2974.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2974.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--021d9808-99d3-4288-8c26-d6a8d7c70a47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2a183dl.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2a183dl.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a11a5653-d665-42c2-ac38-b17a1fa97bd2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2aesc2o0kwo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2aesc2o0kwo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0a40c63-6bea-47e1-87ff-757fa603e9c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2agn9fn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2agn9fn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68556098-f196-40d9-a394-88f89001fb0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2b7dsgps8s.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2b7dsgps8s.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c210c65b-99d8-4970-be85-14e34e314aa5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2cafeqq.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2cafeqq.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a1f4d6e0-1747-49e7-9e1c-cb2fff680412",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2cx9sgpfs9.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2cx9sgpfs9.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9dd8e0cf-8eb7-4cb4-8b7a-1ef5c39c0f1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2ek17w4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2ek17w4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--870a906d-8ce7-41c0-bd3c-d93c3d9bdd6b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2g39quy.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2g39quy.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--337d75b4-3d10-4863-b3a5-b03601b1c59d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2gba9.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2gba9.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7018e75c-cb5b-4005-8ac0-30c864ee4d0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2gr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2gr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9fac9d9a-cf49-47e2-92ee-0b276fffc16c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2id.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2id.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--543a8fc1-f2fd-4b6a-8849-db2068d990a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2m3i7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2m3i7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87a72f39-e8c8-4846-99b8-cd9df9572535",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2m7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2m7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0fc4e919-1cf5-4a02-a195-d03b8a4831c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2mt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2mt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0738c92-19c6-439d-91e0-436040c1db26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2nt83kp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2nt83kp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1dc817b0-3743-4d41-9296-4a49709c7ea7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2oq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2oq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ed0c9c6-0fa8-4e14-9968-4c033c659c13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2os.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2os.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ecce4cbe-2fa9-40ca-8c2b-bbb9e6bfedd5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2pqsii5z7n5frop.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2pqsii5z7n5frop.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88ac56f1-3896-45b5-b43f-a5ebf1d8fb9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2q5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2q5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04d586ac-b0b5-41cf-8bc8-78dc36f71caf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2r4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2r4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd62d072-9b45-4081-9ec9-56141a3b66ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2r5uil9n7fulxik.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2r5uil9n7fulxik.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--caa05065-f69a-4aa2-8247-76d671b67d49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2rl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2rl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69a54457-d8e6-4f5a-be13-e40e0d2131fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2rn5gsj6uwo8j1f.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2rn5gsj6uwo8j1f.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--775d6d50-f46c-42b3-9064-2abfca8ab54e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2rt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2rt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b2e0a58-045e-4881-abbe-0f2e2280ba6b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2s5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2s5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f20807ae-44da-43f4-9971-fdd663497382",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2si.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2si.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b480728d-1837-4b8a-8b66-7073a986a743",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2t1q4.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2t1q4.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8dc4c39-8a5f-448f-b868-f8d6527cff20",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2v3p3era6guqbn7.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2v3p3era6guqbn7.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--225faf23-b953-4f05-bfe3-c28d0c2d90e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2x99sgpc68.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2x99sgpc68.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a280e861-0830-40b1-afc2-8e3fbf8bcac5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2xti3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2xti3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d65b3f54-781a-44b8-ace7-c7aa5c319914",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2xxgjuf.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2xxgjuf.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--325cf178-73a2-4313-a9e0-f367a2dec5d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2y2saycem8m.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2y2saycem8m.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cfaff865-03bc-4d50-9e16-9ea34c16d405",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2yblvzh.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2yblvzh.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0c81684-e96d-4de3-ae86-957576cd5457",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 2yp.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '2yp.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--375eec27-8da6-4bfe-bb60-099d805eac9e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3024.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3024.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f25c6f5-636f-489c-89d8-e9d0950d18ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3030.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3030.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--979fae24-2820-434b-8754-7ba52a81ceb9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3063.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3063.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd44342d-bda7-4903-9f00-a189f10ed6af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3071.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3071.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40ca36a6-b96d-4437-a90a-02435bf84d7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 30c6f6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '30c6f6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c7d2b0f-c905-4726-a4f7-faa1bf2c41e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3117.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3117.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd1f2b70-1017-4699-92c4-cc76a42fc0dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 311996.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '311996.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3da80a94-e1de-42c8-a656-de4d8d6c92e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 312gl97.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '312gl97.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bd21806-04b6-4736-8118-3dc538bb3f5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3133.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3133.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9dfbb222-f4bb-406f-899a-b27bfcb2cf7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3150.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3150.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29ff34c8-9e42-4180-b9ef-8dad512df743",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3156.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3156.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d44cd7b-e85c-4b51-9960-9555340c8c32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3161.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3161.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e737f4e-fa1a-40c1-8a1c-94cd3582ad8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3173.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3173.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8d5a678-e67c-4601-b6a5-b521e2210437",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3181.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3181.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8722bd77-7a81-4950-9a7d-1bc2e90e9ef7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3213.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3213.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a5d9dd7-4a09-4c5d-b4f8-769541454c8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3225555.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3225555.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6b3e068-132b-4a22-87ce-8bd8cc1ec4cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3228.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3228.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5587e89-a5a9-4406-990b-8fd7a66f8a9e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3237.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3237.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54b1e206-40a3-4c42-a3d2-bccb28dec983",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3247.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3247.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c86d5a8f-b240-4cc8-9fbd-39e99301bd31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3258.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3258.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a28a6d87-9244-418d-8ea1-016085ed406e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3278.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3278.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a3ef548-691f-41a9-b6d8-f80f7d28f6e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 32xubjg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '32xubjg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84b0ac9d-d822-4316-9465-920265e4ae14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3308.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3308.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26dbfa32-1762-49b2-8bca-a6f2d9ef34d4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 33165.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '33165.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--630a04b6-b6da-4970-99a6-f3006c6b8aa0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3329.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3329.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d7ac2c9-15c7-4754-8459-b52f273498d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3331115duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3331115duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80f5d898-dc88-4fe9-9c93-e1691c81d9e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3331115fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3331115fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8816cffa-9883-492e-b962-ab96a8f81d59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3331115tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3331115tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ad448e6-7cde-42f8-99a5-a4001b5468e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3331115tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3331115tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a290c66f-1a4d-4afe-9776-8acd4b9c41ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3331115tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3331115tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79834e4d-ae4b-4f0c-974a-3af174ee10fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 333820.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '333820.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98d868fb-7dbc-42ea-89fc-19f881487932",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3359.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3359.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76678436-e4b9-4e55-bdfb-24be06158d8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3360.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3360.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8fc738a-7f3c-4f38-9946-f4ede7f192e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 33667.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '33667.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--015ac29e-94b1-40a5-a1db-c66b14e09f6f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3369.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3369.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b048878a-92ca-478f-b667-105aff439239",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3392.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3392.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c55da9d-ce49-4019-bc72-4ed649795800",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3408.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3408.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5aec928-dbab-4adb-b78f-46f0c44780c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3442.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3442.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--782f7f27-9a3f-443e-844d-ccd0e9183c54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3458.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3458.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--832db648-4766-449d-b27e-8d473f76e1c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3463.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3463.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a37908c9-81b9-4e75-8ad4-0b19e327fe21",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 34o2e3t.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '34o2e3t.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5355f644-daf2-466e-82dd-a8cd31eac4dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 34tc2gglh0252pm.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '34tc2gglh0252pm.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fce3cf1c-110b-4417-871a-6d0cbbebe224",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3504.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3504.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce8d8ef0-8187-4a1e-bc9f-ce44069d884d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3520.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3520.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--468df576-ee98-46c0-a467-f7e81d66c6e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3546.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3546.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc0e1e47-11b8-4fee-bdeb-439a9c3819a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3552.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3552.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c3dfa6a-22dc-4d5f-b075-1128538c873b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3557.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3557.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c989b73a-2673-43c0-bd00-1a24d6d47e80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3562.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3562.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37ab99f6-33aa-4453-9a16-c73786a98259",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3611.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3611.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--011feb2b-d0b2-404b-91c1-e7a44fc3cb9a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 361120.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '361120.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e03a67c-cab0-4704-8a98-418657967e2d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3622.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3622.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d9676bb-4514-416d-b1d5-58127e5c3ea8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3626.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3626.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--507ad5b8-1824-4009-88e2-a709889acd19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 363655.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '363655.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4f21fa6-8b3f-48db-99c8-19b5fcac970e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3640.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3640.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--938e8116-3bde-43c9-9cbd-fc4550f439df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 36546c4f2eaa52fe0e1951705eeeb8e2.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '36546c4f2eaa52fe0e1951705eeeb8e2.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b7c5997-edf6-46a3-9d89-f47dd5331afe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 36f8pc51ls9q2bo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '36f8pc51ls9q2bo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--628786c8-fa3a-4ca5-b498-7bfffc211128",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3708.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3708.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0dbb780f-7fb5-42bd-b48b-2bf40b15742e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3709.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3709.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d277bdb8-9c7c-40cd-bbe2-6c7cf36e6ed0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3714.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3714.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0d00259-d058-4e05-ae68-d01ac0eaefc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3742.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3742.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f852d11-2c6c-459f-93fb-ca7f65258284",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3750.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3750.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8cd777a-a9f1-4a55-8b9f-734310a4c63f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 375266.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '375266.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4401bfa0-8de8-4aa4-81c3-54735b71ac7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 376618.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '376618.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83c948e8-da90-4ffb-afab-cede35da31ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3806.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3806.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9eb22f98-6fa7-4920-977c-31a617b9d450",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3851.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3851.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--729c7012-d3d7-45f6-96a6-bb287e2675a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3876.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3876.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b756c89-2da8-4df2-8a98-fdf01a5d3ac8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3901.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3901.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3aeab7f1-e27f-4512-9873-deb171e60a9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3932.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3932.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93c84f2c-d1f5-41fe-81ee-22289a12f80b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 395.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '395.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b80dc4e2-4ef9-43d4-a340-49410f97d68f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3cafeqq.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3cafeqq.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d188114-82fd-4a62-ba32-9a3ec25e4703",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3ceponates.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3ceponates.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21b3dd9a-a327-4e3d-8b79-ef8e8fdffcf7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3ckyx6t.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3ckyx6t.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--254405e6-f044-4a71-80ff-addb0dc42945",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3dprintsupplier.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3dprintsupplier.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70aaca54-572b-4be1-8853-0c60cb65faab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3dx.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3dx.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35f1db65-6020-4073-a4a4-df90d778d9a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3e688.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3e688.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--827f7d2d-0c03-4bdf-8b47-7e2201ceb089",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3ej.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3ej.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--773c5307-e522-4c63-9f80-5fad8a211194",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3enu8e.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3enu8e.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5ebcb2e-179d-4473-8c5a-767b9e00836a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3f3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3f3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdc6eba3-b4a7-4cc6-9404-fe82dd97d412",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3gb7k.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3gb7k.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab952c6d-8042-497d-89c3-403095f9cf1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3gq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3gq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--719455a1-6759-4033-a66a-8438ee5b3559",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3i7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3i7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90b6806f-9965-458a-8437-4ee60b426dd1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3igmv9l2ivynv6rqx.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3igmv9l2ivynv6rqx.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7febd15-bf79-46d9-990a-71405a473eee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3j1uy8s.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3j1uy8s.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ec43154-50b4-4a39-8ac3-2e8fca658c64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3kf95x0.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3kf95x0.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7c8d5bd-ab03-4bd2-9a70-eeab373f886a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3ky.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3ky.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20ac7b34-f56c-489e-a5c9-fbefa36234dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3lb.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3lb.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb3b6cce-c1c8-4cad-ab18-a197ff84dc5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3nq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3nq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c0c5ab6-c13a-440f-b1b3-1e0516511931",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3oqvpuz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3oqvpuz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48d61f64-bbe2-45ee-954f-c81dc52f5da6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3oy5u8a.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3oy5u8a.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--346f6f2a-2bec-49a5-921d-bc46eeaf6aa6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3pm6h.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3pm6h.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8979c052-5029-4e93-b12c-2b6eedb7174f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3pn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3pn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2651865-1245-45ec-9867-41f7e97aab32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3q1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3q1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c7725d5-3184-476c-b938-cde4b8d43f49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3qkjn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3qkjn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa2ff5c4-76b2-4280-ab39-fccf0740f622",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3qr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3qr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68a1b8a1-a8a8-4404-ae77-7ecc32d3df36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3szo99d2ysfvlal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3szo99d2ysfvlal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d7892d5-8859-46eb-ac01-0df35fea9642",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3u88uuuhf.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3u88uuuhf.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eaa0c385-8b20-45e0-87fb-1684c620c7c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3vnp2k0.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3vnp2k0.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0aba22ed-e9ff-425b-a517-9845dce231db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3yc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3yc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01d2cdd0-e26b-4263-94e0-da18ca003527",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3yu.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3yu.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05ba438f-80c5-47ef-ba9e-088eaa725e35",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3ze.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3ze.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f30f055b-dac9-431c-aa93-4caa16ef7f04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 3zp.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '3zp.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c25b62ae-f33b-4d13-b4f1-60329f84ed13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4014.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4014.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--065aadc1-6f04-441f-bc1a-09ee46ba5432",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4032.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4032.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--843e0239-26b8-4f5e-b8ea-a2ba7b580acf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4033.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4033.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a224170b-7288-4ef7-ac65-7a36c4211c75",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 40884.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '40884.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--327e393d-6fb8-4610-aad9-2ba9db0baabe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4091.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4091.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f38d88f6-2abe-45cb-9f44-4c5c2c37e934",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4151.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4151.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70330032-13aa-4304-9c60-b02ee047ee43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 41611.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '41611.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--945ec980-22d0-4f71-a9bb-02091061a00a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4181.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4181.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64cbfd7c-fd9b-410e-81bc-709a3daf09b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4197.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4197.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c532d6f-94da-46f0-bf00-b033d57f6594",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 41hnqfk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '41hnqfk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09359eb2-e20f-4d24-b926-c79183dd3f68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 41s9alv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '41s9alv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--524a9f6f-c75d-4f83-8cde-1c4fcf7da540",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4200.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4200.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a2147892-b382-4b9e-8cbb-1eb575b0d9b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4218.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4218.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--965ddc95-b595-4ef6-a8d7-e22e6d8f8ec4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4230.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4230.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1000004f-c139-4fdb-86f4-ec78539b412d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4232.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4232.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddb881f0-c822-42dc-9b2b-a3f1eaabb22d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4239.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4239.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fcaa7f9-2c32-4723-ad68-4ec314de97ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4246.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4246.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbc74d47-fcdc-402a-99ee-c31bc3f77d23",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4260.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4260.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ab67aba-1897-452e-857e-e8235d50ef89",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 426ssgpf6x.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '426ssgpf6x.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0a0857c-2126-4bd6-8fd1-719a99e514ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4282.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4282.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1c0768f-dc17-4457-a9d8-679cb868748d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 42823.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '42823.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--929d4083-c536-4039-a6a6-684b6a53d204",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4286.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4286.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--481b349a-30b0-4a43-82b3-b8d3fe1d2e67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 42861.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '42861.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70d7ae29-1bcd-49d8-8fd6-e645c663eeda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4307.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4307.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5462a4bd-4b21-49c5-a8cf-88429b9f6423",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4316.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4316.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91cf5334-e74c-491e-b09a-0daa2457e9f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4324.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4324.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f9550fc-c821-4d9d-80a9-c2b3e0b127ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4341.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4341.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--744aefe3-2c08-4600-b70b-795daa22279e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4344.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4344.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96ccb34b-72e0-430f-976e-0afe31d0018b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4353.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4353.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13b4e8eb-6c0d-41d4-a8a1-71dacb8d7553",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4353459.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4353459.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68f5fe03-4ef7-4d53-8df6-f59dffcd46f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 438758.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '438758.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--edcb80a2-d997-41a3-986d-2056b4083591",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4392.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4392.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39b9181c-94f5-4bc6-b557-0fe416ed0193",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4394.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4394.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9811e68-3e89-48a5-841e-cdec12ad94ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4403.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4403.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a7cdcb3-f76f-4906-a9a0-01aba0177b79",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 443320.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '443320.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--020e4a3b-bba7-4e06-ae4e-1ec2927cdaf3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4453.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4453.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3455443b-c2e5-4709-9a44-be6136a82bf9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4505.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4505.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8a0f7d4-b267-4d57-90be-93736bb11c07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4546.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4546.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26c19ff8-5d32-49a5-8f77-d55a21066715",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4586.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4586.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4252f504-eb5d-43d9-add9-024c3ca253ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4587.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4587.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c1db5da-3437-481d-a787-e1a64e87c918",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4593.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4593.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a532a4e-db04-46fd-9ac5-d380963775d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4611.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4611.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--278d9ef2-8827-4714-a603-8def6eca92ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4619.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4619.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e6f06b1-e30c-460b-9901-d8dc89a15beb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 461twa2rm9xqrdv.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '461twa2rm9xqrdv.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48a94e59-2ad2-4fef-b49e-4f5a43683d99",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4621.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4621.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1791873a-1957-4a41-9240-06cd88c293e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4623.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4623.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4d69563-3b89-4b3c-9d34-8f5e61bcdfb5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 463fhxj.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '463fhxj.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73bba933-8a49-4b79-bbd4-e9114bef925c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 463nu2a.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '463nu2a.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c606e83-a531-4993-9a0b-a7db4dc0a2c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4670.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4670.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91204f58-2d27-4db3-bf1d-b0c2e0583c97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4728.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4728.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--915d1c99-0466-426c-9c5a-4fabc417e28f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4732.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4732.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4fa7c0a-56f4-413f-9a21-79b0d0cbef0e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4733.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4733.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58be0322-9af1-417f-94b9-95328813ead4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4734.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4734.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad154110-38c0-47e9-8df5-50729afa9f3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4758.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4758.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1039e699-4233-4f37-b008-43d54d91cf1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4801.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4801.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54773ff1-0e69-4bf6-812d-b1f98d8ce2a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4812.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4812.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c4ebd31-c90c-49e6-bb5a-7d09f739f1ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4817.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4817.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18fa0796-9f46-4a5f-9339-e2fd88a9d4a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 48170.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '48170.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f38f3622-9a1c-4341-9c3c-63c69b9be65a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4838.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4838.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d6f0a69-b741-44de-a7c9-897bcafb954d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4844.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4844.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--154e75c2-5519-401e-be53-8eb2da8805d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4872.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4872.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68958ee8-f157-4921-9a64-5be278283229",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4890.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4890.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73b38c6c-4fa8-4089-b4c3-48bd63d2a222",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4893.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4893.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5016d33-c3f5-4a4b-a2e8-857ce688b0f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490001.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490001.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a9eed66-fa7b-412e-9dc6-98b07d47e2e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490002.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490002.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--521a03f8-02c5-4743-bd0d-471822fd7f8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490003.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490003.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43b34dd3-5124-4343-a66c-144107071931",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490004.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490004.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9639fac1-a016-4081-b208-96a0c6857185",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490005.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490005.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9030fba9-dd7b-4ae6-8db2-b62147b5faae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490006.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490006.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66874120-6418-4e9d-958c-ad2672d08a6c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490007.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490007.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a27756e0-c7d3-44f0-b6df-cb9ce9114144",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490008.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490008.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d988499f-5b6e-4063-a0e6-6ff3814e44d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490009.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490009.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5f5e6ec-7912-4959-8d65-79436723d2ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490010.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490010.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--468bc336-52a0-484e-9a0f-d7189c5c8eed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490011.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490011.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--466059a6-30f3-4304-a8e5-52713a994b37",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490012.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490012.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39a8ef4d-474a-4003-a502-273778648ced",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490013.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490013.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8facfb2-9f94-4d41-88ee-cb07cf59c0fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490014.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490014.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a1de309-3be2-40ad-9540-34d8e3b5fbf4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490015.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490015.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc7755b8-c6db-4781-80f7-74ec27a29404",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490016.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490016.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--274d6ca9-5277-4c47-bef4-5a3a5be1184c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490017.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490017.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ecb27216-3287-4c74-a620-c37a56da0c40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490018.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490018.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7330148-86bc-4e7b-8189-87baa5497286",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490019.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490019.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20c5f686-c3ef-42a1-8188-bf9b126fafad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490020.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490020.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc0337e7-1a23-4c6e-b33b-a061353a88c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490021.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490021.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b971339d-96b3-42aa-aaff-ddfc5ed862ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490022.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490022.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8cd684a-249b-47d4-9d7e-8d3186d365c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490023.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490023.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82a592de-565b-45f4-8369-54e1fdda0dfb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490024.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490024.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50bf9a51-17e4-48b2-8177-4f14ba1b20b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490025.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490025.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dae56cf0-bebe-48cb-9192-5636e802043f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490026.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490026.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9abe6345-2623-484c-8f07-4f8e5b807417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490027.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490027.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fa56a58-b7a1-4d82-a507-02cc1b96370f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490028.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490028.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4fea94e-875e-4b12-9a9f-2b4fa4509d72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490029.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490029.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc408d92-7e9e-450f-af0d-68869ba46284",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490031.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490031.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8449827-08b0-435a-9297-46f7c1b20cd9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490032.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490032.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16427429-0d6b-4a93-aca2-20d21737ccdd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 490033.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '490033.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b478b68-ab6d-41cb-a3d3-06c72e96610a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4914.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4914.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b867c7c8-11e9-4d76-a253-2c855c04c39b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4918.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4918.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64d4d699-c6b4-4c22-bf2e-aaaae1cc03aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4950.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4950.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--da3655fb-7724-4544-84a7-b28a253bc6e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4965.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4965.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01df4f28-9883-4a50-b10f-3d0a1d4dacae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4a5fd73d66e661caf4a52bd3ac846042.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4a5fd73d66e661caf4a52bd3ac846042.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76c4a19b-d5b8-47b7-ba17-fbc735bba9ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4aw.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4aw.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23a963e0-0016-4ed5-8b0e-9d2de370b56a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4b3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4b3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c831790-e897-4512-8312-84241858cb6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4b5uqa271v33170.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4b5uqa271v33170.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fbfd440-43b1-4ce4-82c8-5e5b8e73220c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4biy3t.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4biy3t.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c6924fa-d29b-4a2e-a6c9-a4519a749ab9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4csl74xty7c3tdi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4csl74xty7c3tdi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23bbd3a4-9a7d-42ea-bf5e-098dc1c33555",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4d1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4d1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fbf1eac7-2478-4e0a-8d55-b60ea61e85d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4do.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4do.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11995a8f-0947-4469-be8f-82f6469b1614",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4fm.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4fm.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bedb0ed9-8056-4b0c-98d5-6fe142b89e60",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4foly93uhyae5uv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4foly93uhyae5uv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5124c3c2-8a23-44f6-9628-6e003e69efc3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4fstore.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4fstore.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--736bcff3-2261-41aa-8aac-97b7166d5315",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4i0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4i0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39e8ce70-6fd6-4f74-82f8-345585c9f153",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4iz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4iz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d362387a-b81e-4dc8-ba81-b292ee8e8eb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4j1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4j1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17078846-d8aa-4cc3-9851-c2bdd3c20e82",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4kthbet.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4kthbet.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--245f5f8f-4c9b-4abb-8608-08a27cc6554a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4ld.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4ld.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e0c5a91-ba34-4670-8054-1f5d1cd2df16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4lk6j.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4lk6j.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84631ac0-dde9-4721-8746-2087e4aaf8b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4lpsbny.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4lpsbny.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f5c9acf-673e-4506-b17a-cd5174046c8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4mdcf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4mdcf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c4f5145-6bd6-4f3b-a1eb-4331a73a131e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4nffmmh6irjtlac.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4nffmmh6irjtlac.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98014a78-f33d-437e-a494-d08a7fb56cec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4omcyndcefvylx9.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4omcyndcefvylx9.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b6f802e-93db-4843-95c2-988763624548",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4rlbq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4rlbq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8196d025-1e10-4631-8a4a-7ea05f022ed2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4tgu0sjubl2vpb4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4tgu0sjubl2vpb4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9add3c7b-76f2-4bf7-a803-0308dc834955",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4tzq5n9.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4tzq5n9.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b34d4922-812b-47db-b3b7-fe65d2ccb0ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4u7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4u7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6bfed575-347e-4c1f-b8db-27edf8e4066a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4w4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4w4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38f85134-6658-4700-a754-c467960363e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4w7tlbbx0oo2i98.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4w7tlbbx0oo2i98.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f152cf0-2819-4102-a010-0ede7bc5f58a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4wz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4wz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6bd2a4d3-031f-4d26-8fea-0172fdd88117",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 4yd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '4yd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89c95240-e3bc-448f-b6f2-1fc5101e1a4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5002.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5002.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--02dd6472-64c1-4a46-a6a4-203f6dce1d11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5006.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5006.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06486ae0-0d15-4245-b3b5-3656ac71acbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 500hao-dd-rr-xx.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '500hao-dd-rr-xx.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e166da5f-248d-4566-a09e-a87536f52b29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 502366.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '502366.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7ce21daa-ca75-41c6-af4b-0128359c5b7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5032.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5032.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--072866b4-ea85-40a5-9e58-bd9f73ff75f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 505bx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '505bx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b804ad7-d6f1-4010-b880-d59f25bfa2cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5070.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5070.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d1ee1ba-0e1a-4f53-82a6-bde015cab2b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 507315.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '507315.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc62b8d4-7356-4fea-bf31-287fa2bd2aad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 508883.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '508883.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0e756e7-9922-4454-8937-428126a26f06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 50cn9l3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '50cn9l3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc415cec-98ca-4bd1-a71e-098e6051cecc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 51000.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '51000.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db22f369-8e0e-48a7-86a1-0975babf0b63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 51263.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '51263.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c9ad9f3-075c-42fc-95a6-de382edd7bea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 51828.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '51828.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--628a2829-785c-465c-9cd9-b318bd63acaf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5190.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5190.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c0551cb-c454-4e11-8f41-7d036e47a6ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 51xjdui.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '51xjdui.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb1e77d8-928e-4853-be4b-b20aff3cf86f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5232.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5232.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22d17dc1-3618-450a-9873-215634991d4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 524013.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '524013.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae362dbc-5bc5-43d0-b35b-1f2f4498f0fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 525155.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '525155.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf918723-3312-4ae2-82cb-ca9127a10652",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5265.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5265.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9553243f-8b0c-445b-9740-18274d7f260f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5286.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5286.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e9408c3-c268-40ce-9f96-16f3c7828244",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5290.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5290.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebf68fa5-9a1a-446e-8c82-a53ed89c1fe9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 52k1et.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '52k1et.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3cc7369-fce1-444f-b237-626203f7e78e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5302.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5302.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9cdc4129-48a4-4c67-906c-d3db91fe215d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5304.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5304.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b50be72c-ec10-47b4-89e0-1e1ed796337e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5323.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5323.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d8e208b-a81f-463a-b8d8-749980c9e6a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5327.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5327.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dae5989a-1a0e-410c-a387-7ce7f20b00a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 533005.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '533005.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8f4cc2f-875b-497d-aa1b-dbb8b1b9a7a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5332.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5332.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9e561be-4c33-4385-a500-bc596d42ffe6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 53625.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '53625.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9cc8029-74eb-4898-b29a-30286b66f73c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5375.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5375.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9131f3d3-5a41-409b-a548-89265964ae59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5390.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5390.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fee76eff-3828-4c75-875f-e68527306706",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5437.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5437.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70d5b2dd-0060-48f7-8754-df0815df3f2d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5456.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5456.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51277965-b9c7-442b-883d-a46fd92cf311",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5464.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5464.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a9e1afb-2754-4735-b099-ede6b9f614a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5468.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5468.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--945abc18-0241-4e64-bb8d-b56025202851",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5470.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5470.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e015d08f-4ca2-4acb-aacb-f6ac04691071",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5480.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5480.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--209b8c75-940e-4a18-ad21-e1f349a5234c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5504.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5504.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6afaf1ed-0ea6-43f4-be1e-7c6f601e67e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 551557.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '551557.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5bcba5b-9b6f-4f05-aa4c-f48484311713",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55276.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55276.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16f816a0-8dc2-4a3f-825e-4d377d1e2ef9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5529.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5529.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--810b0ae1-bab1-453f-abad-7b74b0b75df4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099a1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099a1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--598f4b09-f264-4d70-be26-5e4036dced1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099a2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099a2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0ca101f-0f3a-411b-8f2f-52ea33416db8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099dh1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099dh1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0dd55cab-f405-46d5-8edd-e15ead46a945",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5005cac3-5bd7-432b-9c5b-734bf06318aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31b0c0a1-a6b1-4ee2-a9e2-c098681604e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8891ba4a-d35c-44b6-88d0-1d37974288aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e7203d9-2a15-42b1-9305-cfe9cb5fb419",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55550099tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55550099tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ec37967-e5a3-4706-912d-52940cc6a01e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613a1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613a1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76f9985c-7fc7-4b2d-8390-2db06c2ac605",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613a2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613a2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56003fbb-af16-45bf-9f69-bed3803090c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613dh1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613dh1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad844a65-eced-40c1-ada3-f696adac4ccd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ffe0d72-35d3-4a22-8f27-57f17cf7a924",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29fadfad-4de5-4ca8-9be9-c6abb2c62f9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3eb64d9b-437a-4e3f-849b-85fa1c7a7e88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8e049a1-b402-4979-b832-a3151ee1b8ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5556613tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5556613tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0de4975a-e043-4b97-82cc-2076348d6d44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55595.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55595.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--da7bfd21-5da4-4e2c-9b8a-1e1b4e3bb826",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55618.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55618.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5f1326a-9854-4f36-bfd4-48afbb0ebffe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5572.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5572.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb37bbe6-af21-43bc-9f78-af3203ada10a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55769.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55769.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--088ea41d-7a55-4977-a443-eb59e17eb795",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5581.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5581.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1f98595-ba8c-43d3-87c1-c86182ae9437",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 55bssgps84.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '55bssgps84.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f119c8b-9ba6-45a2-a79e-ad62c396efa8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 560262.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '560262.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a828d22-a895-4ecb-9679-f54671438d9a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5603.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5603.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb562456-1d71-462c-9e6f-7476e056431f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5612.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5612.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b7349f4-0a8b-4a86-acd8-917cbe0d779c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5625.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5625.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3c09559-1b55-4d5d-a847-1f2322007561",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5627.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5627.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e367f88-32b5-4571-bc9a-d7e36d542ff5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 56301.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '56301.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f384a18-0e9e-429b-8126-f438b2c7c74f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 56345.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '56345.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44099f27-dfa6-41fb-ae43-45c90a04a800",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5635.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5635.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f77a64e6-c513-45a2-a202-7c5f2f3732c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 564.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '564.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b52496a-4571-4810-b39b-1a4fde2bae92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 568013a0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '568013a0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4dbd2a1-f665-4709-a63a-5b96c4640f11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5687.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5687.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b1b5b60-4862-40f6-87ab-d7e49f13477e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 56q.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '56q.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--815b6f5c-c849-4695-8dcb-5f8cb6c67296",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5728.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5728.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cb5722bc-e05d-4dc4-889f-8d429b1d1e2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5742.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5742.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bfbcae8f-db53-432d-8d25-74916ae706e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5761.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5761.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--092c0404-7166-42c1-bc72-e6463b055cb9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5768.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5768.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d277739-3fd7-4ac4-84e6-24b5329d62a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 581056.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '581056.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15e96bed-ee41-4f08-8910-29ccfb9f1c07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 585ea0.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '585ea0.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86a66bac-e32c-4036-b780-52ba01ff992a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 587711.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '587711.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b864278-9477-40a4-bb1a-37fb5a703929",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5883.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5883.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6081a23d-8b01-4b1b-94ca-d6cd0f495ea4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 590991.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '590991.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdccde1d-d154-4851-a67c-f90bbf903779",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5911.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5911.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23d5c78a-4600-4ac4-a4c1-cabd3e941ddb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5930.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5930.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f8dc815-c330-4b66-b532-565501d4ebd0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5954.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5954.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ad66326-b0f3-4dec-9c09-94708a036625",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5960.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5960.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc47b730-b627-43fb-af7b-7ed86f6acaa6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5963.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5963.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bc4c06b-bad8-42c5-9522-bcac08432d4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5975.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5975.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a44888e9-d371-4775-874a-3c7e7003a947",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5994.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5994.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--faa2eb6e-ba4b-4ce7-8022-5de474a5b87d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 59eesgp767.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '59eesgp767.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96e90e0e-e1bc-45fd-824b-1e75837e2431",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 59n8o.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '59n8o.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e06e4a4c-9f88-485a-8321-d90041a7e4cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5am.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5am.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4969af7-7195-4e3b-bfd4-0423b149171b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5cw.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5cw.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f410fe4-ecfe-417f-8983-b6c6e7fd29a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5e3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5e3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30cfd109-6395-4edf-9521-67edf85208c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5f1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5f1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e57bf4a9-703c-447a-a95a-074f60d21946",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5fpft94.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5fpft94.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84cf2c06-1eac-4fd7-ab19-9f07c721298d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5jb.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5jb.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6cea22cd-2a4b-44af-aafa-f0f3889bf6ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5ly.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5ly.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee72b9d7-c9a7-4756-9916-cda4906b695d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5mk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5mk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--706492de-2d56-47d6-861d-6cf99197afc2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5mr1e.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5mr1e.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf223a67-00aa-4cc0-b54a-4093d210929c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5p9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5p9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d0761d8-0a18-4eea-a36a-889afd291ac5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5pj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5pj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec930faf-0ee6-401c-92b5-078c606aadd3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5q05s.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5q05s.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1cb046a-05db-4c0c-aa26-aa43ab869bc7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5s2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5s2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7f5f6fe-3ab1-40f5-8b40-2be1e7aff39e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5t1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5t1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--410803c1-a7cf-42b0-9074-5b153d4ff14b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5ve.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5ve.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebe4ee26-fe84-400a-beea-023d9894a2f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5xy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5xy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea9606d2-8ecd-4457-af38-1aeb49a37be4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5z4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5z4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef58ad35-4efa-4829-8384-d78c90a5ef43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 5z7iusw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '5z7iusw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fba6e625-fe8b-4da5-bb11-f4fcdc9cd6fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6024.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6024.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60ada975-6ee7-4981-a15d-0aa8b68fb67c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 604524.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '604524.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--035364c9-0555-4e03-980f-33d336b36861",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6062.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6062.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67adb9e5-9133-4e20-a1e4-98248c794112",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6081.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6081.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3c4f533-084e-468e-9372-1adc08b9e009",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6085.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6085.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0fca1819-8615-4a3b-86b7-6ea5b26ff431",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6091.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6091.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad4ecfd8-8108-4d98-9339-9be44bda492c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080bbljpewz9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080bbljpewz9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65c2c17d-1976-48fd-82c4-66736cfcb419",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080hipqjrux8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080hipqjrux8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3789ff3a-99f1-4608-94fa-56ce306d4617",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080ibqvvlyf2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080ibqvvlyf2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9dca88e-d8c9-4bc7-9b8f-6a2d4201dfce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080jujmbjsd5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080jujmbjsd5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80feb742-f12b-426d-8a2f-ad2d22d6fc7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080seifkkgc1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080seifkkgc1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de77705a-a3e6-43b5-8c54-2f405e0fd6ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080uloeheyo3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080uloeheyo3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--090078a8-ad7b-45e6-a641-bef6b67a925a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080xjnplgso0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080xjnplgso0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d41b388d-1343-4ebb-afdd-1f19ddbe09a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080yddabiuz7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080yddabiuz7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12b847b1-5168-4218-9e7e-296ccf0bffe7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080yhyxfgxt4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080yhyxfgxt4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a25b3861-1fc7-4f59-b92a-e6c53746bced",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6110080zgpxyjkc6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6110080zgpxyjkc6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67801aee-ed31-4703-80f8-9060618b5c28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6130.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6130.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3a115a8-271e-4db2-805d-98eeb9581eb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6134.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6134.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e97fe081-1781-4009-916e-bbdb8fa45b14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6152.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6152.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3264b80e-24fa-4ed8-bd24-1f9da58745c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6158.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6158.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--507e9936-a71a-4b3d-8fe2-e61c9e5cdf64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 617361.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '617361.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7df8ec77-5563-4a8c-9a94-bf3c5a977f80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 617832.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '617832.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4b9c64c-59fe-4edb-b929-13694a5b3d48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 618128.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '618128.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78732be8-2d7f-4afc-8c93-e25eec84b090",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 618180.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '618180.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17edb30f-3ab4-4f1f-953e-85000fca115f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6195.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6195.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3a6d8fd-2fb2-4ee8-8fa2-daa7e35185ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6197.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6197.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ebb819e-376d-4810-ae30-a22b7e606399",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 62103.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '62103.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1fa51b3-c779-43fe-8414-68f142eaf7e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6223.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6223.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--638be8fe-e424-485d-9653-8652d390a584",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6231.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6231.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3f636b5-9afb-4d91-99db-f9c2ec028b07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6270.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6270.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e8d22e8-43b3-4017-9c74-b12730f3bca0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6281.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6281.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed2a886c-319f-445c-a60f-6c2227ee80db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6286.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6286.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f25505d4-a6e7-4667-9639-f0c2930f67df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 62comg5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '62comg5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83c9fa86-e506-4584-97aa-46afd596be2d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 62dc5162.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '62dc5162.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b485a2c6-d38f-449e-9bb2-9d62ffed1cff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6311.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6311.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d9600b2-81af-4e24-b821-ee03ea945e26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 631525.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '631525.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c47849dd-cb58-4bac-896e-43790694c5c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6345.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6345.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2ea87e7-c527-4d03-a240-755c029dfdec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 63d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '63d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--796bc1d0-2397-4b41-908e-e1a91236962c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6423.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6423.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d12a8183-ec95-4836-b2f0-a518ec727734",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6432.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6432.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3940771e-1364-4424-abe5-c4a0920457ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6446.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6446.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01c96349-3c39-4e40-bae2-158bc3e3e0c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6461.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6461.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33160b3f-dc49-4d91-8ffe-bd7843ee787a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6467.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6467.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--842fc9b7-a557-427b-ab6c-672d37073d1c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6478.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6478.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1032a007-a588-478b-a0c3-83f374f131ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6485.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6485.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d74c5722-25e7-46d5-a871-cca7f908e6f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6502.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6502.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c0de31b-909a-4469-be3d-ff5928f4a68c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 650shja.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '650shja.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2382a731-8c4e-4c26-bf5d-42f1d8216ee2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 65164.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '65164.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b71f4213-e045-4baf-bb0a-97184ee0f3fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6522y2qr0h44ql4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6522y2qr0h44ql4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d065044c-6ffc-406f-8adc-c65289e4d49a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6544.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6544.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22381e77-4abf-4597-afd7-4a373f4df9cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6558.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6558.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5eae962a-e434-49ad-a823-7b193110784e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6567.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6567.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--912218a7-ddfe-41c8-bfad-c0645a76a6ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6593.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6593.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27e9ff52-3685-4dfd-8473-e73be62138fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 65n2tpd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '65n2tpd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76f09b92-d3b9-46be-9207-812404000cdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 661176.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '661176.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c50aab17-f5fe-47d6-9d6d-add843326614",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6685.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6685.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64a91d2e-d7a6-43ad-98f9-118aa2b50837",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6688.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6688.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7423852-4ced-4006-9677-5542413248c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6689750.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6689750.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac16d7d2-662b-4546-9572-21f580cfdbdd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6706.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6706.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25bc921c-0200-466d-872a-f4f5014dea08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 671161.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '671161.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3705b8bc-69b1-45be-819e-5139f2510fe1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 671916.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '671916.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e200dbc4-19c6-425a-8652-86e2c1b9dff6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6738sgp29b.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6738sgp29b.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43332e9c-4793-47d4-bfcc-2897ab42aeb0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6740.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6740.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ccf07a86-d690-46e0-be78-33a5c96188b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6742.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6742.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3211cf86-2a94-4995-ac52-64eefeecb312",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6778.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6778.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7ea6ed3f-80a1-4af6-9222-b8207be31ef3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 677882.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '677882.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ae62587-0997-45b8-8524-d7dce487d844",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 678513.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '678513.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e5b280e-0e7a-4bf4-8df9-440be4567cc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 678sep.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '678sep.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--458a57c2-eba2-4d26-9a96-2570df3cbca3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 678sps.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '678sps.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77e2c2ad-3b93-4f16-8d44-d5b1b1cfa82d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 678sps.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '678sps.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9999d10a-3368-42c3-b908-7637c6294d9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 678zp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '678zp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--860e7331-6f4a-41db-9398-7df0d9d98295",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 678zp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '678zp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e36a3bcc-c4cc-4189-8c73-2e5b2f81846d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6857.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6857.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66325976-996e-4d11-a615-ad3eb7f30091",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6872.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6872.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64b59f09-085c-45c6-b533-ee23e87cf648",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6882630.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6882630.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66f743cd-3c50-4682-a8a0-f7326213c996",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 68o48p4wo3wwlkm.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '68o48p4wo3wwlkm.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d2bec6b-3fbe-430c-88ff-0c7a18a314ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 68z.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '68z.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c3e3641-8e7a-486b-bc6d-317bb5abcdf3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6930.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6930.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf551dc6-ff1a-4b0b-9249-1c25bec2eef5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6946.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6946.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8489aaa-128e-408d-8008-5cdb75430758",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 695551.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '695551.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2eec039f-e04d-4a25-a88c-23f8e98d46bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 69573.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '69573.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--415ee805-c4fb-4a15-81a4-017022d2768b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 695868.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '695868.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a487d1e-f7ad-4ee0-bb34-a1b4b9433e11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6965.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6965.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8630578f-de7e-4503-8506-2ae8aae3cdbd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6988.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6988.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf8264d6-aa36-4056-a9de-71a1abfe8ff4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 69jrtfd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '69jrtfd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--402c7649-8b5f-4534-8a79-f70ff46b3dbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 69o3db1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '69o3db1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fec6c0fc-c656-4077-88d0-b3bd0dbcfea1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6a4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6a4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35d13062-1406-4c40-a57a-6fe935a99d4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6b6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6b6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96e0810d-8f22-443e-a675-eeca3a06a8e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6bl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6bl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f297a1c-38a4-4eb6-8885-3f8d677c67af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6ck6u.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6ck6u.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fba025d-0e1d-4c52-9395-3ddc9f8bb99e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6dexsgp8fe.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6dexsgp8fe.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7554a41-6637-471b-83f5-aa2eab13264d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6elgjkc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6elgjkc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a050d75-b931-4421-b3fe-3c7757692aae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6f2fsgpfdd.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6f2fsgpfdd.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c24af6c0-546a-473f-bb2f-69a761f276d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6il.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6il.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8bd13eb-4696-43cf-ba88-4b8d68b101a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6jb.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6jb.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8eda258d-c0d6-446f-af97-497eaa747559",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6jj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6jj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f6fe2f4-fbdb-49e9-ab7a-d54f310ca143",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6k7gul.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6k7gul.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b99313a4-2de8-4153-a64a-86d0f972a266",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6kq6ec2eaks.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6kq6ec2eaks.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11af510e-4d65-4e9d-8852-40280e70391b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6lc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6lc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebe4be77-c243-45ee-94ed-6dbbd3c5f252",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6o8mafz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6o8mafz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--baa4ee6a-db3d-4585-bdb9-446ab2bfbdae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6ph1eexpft.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6ph1eexpft.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fee87e8c-5c24-47b6-99b6-3daff4c5f653",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6s7fhms.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6s7fhms.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cb8cab1-70f5-48e2-a21f-f6300f238d36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6sfxsgpc7e.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6sfxsgpc7e.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8fa92cf-c486-49fe-8385-063182d3071e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6szcao.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6szcao.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b63bc344-527e-4d01-b656-04cdac77d83d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6ud.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6ud.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db651e5c-d2ac-45ce-b963-8463f406f80f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6ur.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6ur.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67288afc-72ad-44d8-925f-ed505bbc91f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6ut59tn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6ut59tn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5dc999c7-c037-4d69-afe6-9627bb3ae2df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6v78xisd94kq30a.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6v78xisd94kq30a.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce9a4da3-419e-4bb3-9505-c6c2e1d2a6d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6vi.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6vi.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c5d5edd-6e3f-49b3-b5dd-8af97e986df7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6vo.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6vo.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5ca2d6c-9a25-4355-bba1-f5fa5002b4fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6vr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6vr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--594e06e1-9210-4273-8097-de31a98bf3c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6vwxh.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6vwxh.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bd208bb-2a35-4927-ba43-ef9ae70f26e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6w5p3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6w5p3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57827bc7-beb3-44f0-8cdc-d4b13308ef1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6wwpmrw7619rdokn09j.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6wwpmrw7619rdokn09j.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b33dfb50-fb17-46b9-960c-206732c5ed1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6xou0c3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6xou0c3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5ab683f-ccbb-4821-8d5b-4518f048b872",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 6zr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '6zr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--760dfd73-f37f-4f40-aa0d-4fe63cf855ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7001.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7001.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1cf538b-d4a9-495a-8135-e6dad2e25819",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7007.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7007.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43c76400-917c-4a03-8a72-99a4c010e7a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7017.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7017.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20777e59-4abb-43c4-bf4d-23a0d78ed472",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7028.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7028.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--113aed4e-d625-4c52-8317-7840fe292bdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7031.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7031.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b33432c0-639a-405a-8770-eb14b207a433",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7064.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7064.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc9094c8-3c94-40ca-a6d9-7ea92cfa4a56",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7092.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7092.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46b18af4-a8da-4a45-88c4-e9bcc32f542c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 709518.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '709518.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8f3ba04-d144-4215-8a7b-ec7b7aa63e47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7103.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7103.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9dda90d9-446c-44a1-89d3-c9711f11eb10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 711359.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '711359.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--082f8db6-267c-45e2-8201-a9ae0bb98cd4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 71317.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '71317.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74be6a40-aa2f-45ca-8214-1d7e09bd123e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7151.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7151.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--317b2ae9-70d0-4622-bc4f-d8834be8bfba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7157.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7157.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ea9251f-ec99-4793-af66-56dbeb080033",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7176.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7176.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b432939-190a-4967-aba0-495e94ae1a1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7188.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7188.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc33bd0e-4001-4a15-87a9-f5270af1394b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7201.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7201.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19fd517f-baa7-465b-b402-51cf90196411",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7207.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7207.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21dfcd8c-a5a2-4323-ab24-484cdc255f8c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 721156.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '721156.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee5a652b-1a82-44f0-b473-b1b255bc9c46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7242.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7242.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e631d55c-a9a3-4af7-a686-c8098b5bd8b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 725223.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '725223.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64827928-18d4-4c49-8e5a-59cee7af42d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7259.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7259.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18141f2d-400e-42b6-b5a4-6d5654b0c1ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7308.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7308.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e954e26-5dab-4471-877b-b340aa75d246",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 732268.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '732268.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--889128a8-b9e9-403e-9a81-d4f1d97d01c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7335.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7335.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7a4561e-2a79-4665-b012-9470008de3a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7349.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7349.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--880e18a4-f912-4d16-80f4-21bd84a86acd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7367.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7367.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c24bf7bc-0e11-4cdd-bc55-5a67c2157036",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7380.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7380.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3177f37f-8871-464a-895a-31304c238a3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 73jn2cz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '73jn2cz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17fc538a-598b-4a31-959a-2644e282f064",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 73jzlyg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '73jzlyg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--984da510-8009-4dba-a85d-099bbd6ccebc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 73u.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '73u.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f50d2ff8-31a6-4162-8ae4-503bc367efa2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7419.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7419.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30a8cb59-0750-44ea-97e2-038c0a53f854",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 742957.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '742957.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f70d78a-54f6-4ef0-bdc0-40cc73992807",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7459.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7459.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73337980-2b74-47a2-9e8a-2e6449db032c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7476.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7476.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--693f6042-b446-4497-a123-bd8f6b7501fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7485.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7485.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffabbed8-44d0-4c6d-82d8-8b5ccf8392bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7494.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7494.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ebdc028-a241-4fe0-b5df-a71503fd1847",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7503.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7503.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0d6ed6e-9b03-4fee-a7f2-60ae97c55eb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 75327.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '75327.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c7dc1ce-af1b-4c57-9d27-e56ba616fd60",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7563.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7563.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86641eae-bfb1-479a-9daf-2658656b5652",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7580.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7580.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ba35e36-bbe3-47b3-8cca-6551740553e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7587.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7587.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bc92b71-80d0-4bcc-8907-c4df67ed57af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 75e.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '75e.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd125160-8230-4fb3-9b21-8d4e1d4fb6b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7649.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7649.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b927303f-9049-4ab3-8430-bd1bf2fed2a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7653.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7653.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b4c41c0-cb11-454e-a39e-551f82807af4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 767131.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '767131.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dcafa49f-af41-4e89-a00f-453435968d93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76afyp-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76afyp-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9b5b90c-c043-4dc2-8fb0-73bdf1cf2523",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76amac-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76amac-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee22accd-c357-4e2e-a7bf-e84b6ddc95c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76aqiu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76aqiu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--010dbed8-5a1e-44d7-a8c9-df85ab20b101",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76aqxs-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76aqxs-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03edce67-2401-4c3d-8e93-0af20e8f9cfe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76aubr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76aubr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53db5d69-d94b-486b-8726-0ff54c5305f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76baro-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76baro-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d840091-695f-4bba-b13f-4ea2a533073a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bbnj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bbnj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97685f8a-030a-4842-8985-2adb58027305",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bfvs-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bfvs-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34d3f634-9919-438a-90f5-210acbb3d77c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bgzw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bgzw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2612519-3a14-459c-8292-beeacf3a5b44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bklo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bklo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be851335-d256-4faf-a810-8614fee07912",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bnba-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bnba-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3fb08508-d4dc-4b2a-ace6-0278e3cc820e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bokp-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bokp-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68dcc2a8-36e9-4685-a560-fba056ac3de2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bpmr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bpmr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac5e003e-1b27-44ff-b31c-c6d6a989af2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76brqb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76brqb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7276e25-1079-415d-b4a9-c9ddd2cfd21f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76btju-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76btju-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3b6faba-2046-4a62-a455-2f2de3648ba1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76bvrj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76bvrj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e33383a5-dd72-4012-b95d-07aad00d396f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76cbvq-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76cbvq-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6dc4f2e6-f8d0-4833-b0ac-4c22d6df4fc0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ceeg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ceeg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--694c4247-46f9-4474-bf11-a96477475f52",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76cfue-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76cfue-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11b2392c-5850-4e7b-a4be-fc6563e10823",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76chut-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76chut-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b32302f1-be36-48f1-b6a2-bb2b7bee750e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76chyw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76chyw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40df5b45-e3e4-496d-9764-24cb100f62e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ckrm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ckrm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08cfab86-a091-4a59-a78d-6f97de5b285b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76clnc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76clnc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ff643eb-69d0-4468-8dc2-a598fe3adcbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76coem-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76coem-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54192beb-7cb5-419f-b17b-1924ae653c0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ctfr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ctfr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c252181a-1aab-4aa5-a14d-eabcd5efbdae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76cxuf-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76cxuf-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82e139f8-8f69-4c6f-9e00-ac2d285ab763",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c3e41cd-1e0f-4cb1-8e24-46a6de15e3fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76deko-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76deko-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--abed6b83-82b6-4105-b4ab-cbf8d0a3f43c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76djve-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76djve-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39f17586-f456-428e-929f-1df9e3165be3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76dltr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76dltr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8c37a2e-94d7-450f-b5ec-1c0b0028b9a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76dmjg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76dmjg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81bfbac6-5975-4f1b-bdd7-9cf4ae1d7c3a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76dpka-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76dpka-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1583b55b-cc32-487b-86bd-37dc10c2396e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76drhi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76drhi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--894f8dd0-3c85-4091-96fe-259f3797619b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76drqs-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76drqs-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--246ff97f-a7b0-4491-8b6a-db13d74d6f9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76drye-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76drye-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8e9443f-39a0-483a-847f-1fbf4f78bd88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76dyyf-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76dyyf-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec4263d6-8cfe-4782-b332-16c54123d86b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76dzff-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76dzff-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9da87f47-7bb7-4573-bea6-039d60a55473",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76eckk-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76eckk-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--994cdcc6-747e-4c4f-960e-0e9f51a5bb2d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76efjc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76efjc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c697dd4-598e-4f30-b86f-7eb2ef62f8e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76epwj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76epwj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a771ace6-4318-49ca-be74-0b58b57c5025",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76eule-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76eule-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d07e74c6-23ff-4a15-84dd-dd60a1afa84e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76fgiu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76fgiu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af813816-33fa-47e3-8c67-a5b2ebfdd7dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76fius-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76fius-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--865fdf65-1b15-4639-bba8-74496356fb0e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76fnwi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76fnwi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--980b571e-5d38-45ed-9988-2c1de18c8feb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76fpmg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76fpmg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de13fd30-2f4a-4b92-9d3f-895743b79718",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ftvb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ftvb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71da7f49-6b1d-43f4-826b-0354e6145819",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76fwye-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76fwye-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e6e3b03-dab8-49be-a3d0-af0031783ddb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76fxjl-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76fxjl-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6313f3a0-c22e-4f43-9544-46bc5d7dbe25",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76gcee-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76gcee-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--283bc9b3-c550-4a71-ae48-47c809d12c7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76gfcz-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76gfcz-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fff0a4a6-f6e0-4e7c-866e-7874c944727e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76gfph-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76gfph-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c8ecea3-9555-4d14-b513-314d270ccbc3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76giyv-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76giyv-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c74d0d38-c320-4ad4-8f43-21405d1cb270",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76gljl-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76gljl-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18af7b6e-ed98-43c5-8201-7097212d88ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76gvyt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76gvyt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52291e09-595f-4b15-986f-e1782699ed90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76gywn-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76gywn-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8dbc153-2a87-4d22-9750-313d518a272c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hbcj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hbcj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c32e8b4-821f-4a48-95d5-c390515720bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hgov-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hgov-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--608265aa-5fa9-4080-897e-9b7771d2f9bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hixo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hixo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5435acc0-db19-40e6-8b87-60d2f3a99178",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hjzk-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hjzk-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d76d243-dae0-4418-b36e-1119093afa4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hqvr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hqvr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3279f23-dec7-43fb-994a-65a77765f5a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hscq-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hscq-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--008168a4-ea6e-42a5-987e-568bd4f401ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hskl-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hskl-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2d852a8-6846-4da8-9e9d-5a55344fb27f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hsqk-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hsqk-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffc2ecf3-f87c-4285-a773-0fcacfa1f847",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hxcz-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hxcz-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d445d62d-c4aa-498d-9017-ac71d9c16376",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76hxhh-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76hxhh-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3870bd9-9e98-4a1f-8b05-f0a0928ffc0a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76igwi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76igwi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f27d458-35d9-49d1-8615-1c3011e4da5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ilgh-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ilgh-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae743c85-df44-4220-8be0-3125223c093d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76itjs-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76itjs-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f165b10-3434-41e9-b8ed-156ad7bee5ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ivlu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ivlu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61f8082c-7da6-4b6e-91d5-cfe858ec9fb8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76jaqm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76jaqm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--336a2732-b010-495d-8eb6-32ebbbf12bc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76jfrk-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76jfrk-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9126d97f-97a1-46aa-a3a8-5cb112d5e439",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76jnmw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76jnmw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79bbaa8e-90dd-4221-baf3-6b3ea9eea528",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76jqbg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76jqbg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8eaa1183-2d4b-44cf-92f5-267dd80f4310",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76jsdx-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76jsdx-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7ce54d8b-29b4-4f68-8ffa-5ee48e4453e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76juvj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76juvj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eda7b202-bb9e-4057-b9c1-2fa415b20305",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kadj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kadj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--396c12f8-222f-448f-b868-2176b5fe8c91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kdkh-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kdkh-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87666112-cc5d-4ea3-abbb-2145fc9b863f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kdrl-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kdrl-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9baf9c3d-056d-4f5f-9dd6-9ff530d54f76",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kefl-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kefl-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06eef059-e816-41fb-8de0-ef2f52d763c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kfkf-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kfkf-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fdaa8b56-96ad-4257-a472-dfe762d98ede",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kgwc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kgwc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44fba477-a312-4be6-8f24-78e20b094366",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kiuo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kiuo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf1c0233-2c7c-42b2-b9d0-27f6bc59725c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kqjt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kqjt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0443102-6a13-45b2-a48a-158999362621",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76krrb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76krrb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14f59890-d6d0-43a0-bf6c-fa9e015290de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ksxz-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ksxz-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa79dcd6-226b-4545-bc9d-c6bdf75eb7e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kuhr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kuhr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6c794f7-a33e-4dac-8e39-fb8006e69e98",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kwog-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kwog-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7eb7a54-cffd-4401-842f-e8afdcd5c01b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76kygo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76kygo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--321087b1-e020-4078-b93a-574e7c43a6d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76lcgf-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76lcgf-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aea507a5-4e04-4fbd-84c1-b3ba7653d2b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76lcvu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76lcvu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--10d31c52-38a7-4756-910e-c111de7ed05b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76lgho-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76lgho-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ec497eb-5910-4d9d-a33f-87b9fd81b5b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76lloi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76lloi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca5a4fff-e782-444c-baaa-927d0d25dc5d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76luas-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76luas-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8597a8c5-7c73-4ec1-8fbd-29f039be3c4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76lywo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76lywo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8f8dc0d-b06e-4a69-97cb-c474476e9a32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76lzoj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76lzoj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77bfad96-e6d8-40b5-b310-f8b558fc2fed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mblx-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mblx-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3ff1aad-4c8e-45fb-b3df-af29c73ecc95",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mfah-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mfah-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--645742f6-8c17-4d4c-8a44-18a192fe627f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mlpk-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mlpk-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b99d988-69d7-4ca7-a2df-5eeee6a4d03b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mmbj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mmbj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2acc018-7d0a-49a4-a54b-0acc5decb160",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mojc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mojc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd69e844-1049-4689-847d-4605e4bae48e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mpsw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mpsw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd1d81e0-f1d6-4bf7-a6e6-e23b398f2174",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mpzn-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mpzn-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--369dfe77-bdba-4259-bb46-4e81bf2ace9a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76mtrr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76mtrr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ee42130-602a-4c95-b532-f7df1f1a7a16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76muek-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76muek-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e0bd419-42c6-439c-b54c-17e45713bec7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76myil-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76myil-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27a2308c-3406-4585-a761-cdae8cff14ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ndjt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ndjt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b64d8e2-9bdb-41fb-8616-2c4791675751",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nfdf-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nfdf-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fea5decf-1f10-4f29-b2fa-31f6876dc8e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nfyy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nfyy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b4c201b-5149-4ad6-a917-46c4d58d28e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nicy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nicy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ecbf52fa-9c30-4497-875b-0801a601da8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nkqm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nkqm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64e5b7ea-74ca-4016-9d11-49ac8f3ec88b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76npmt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76npmt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f45dece-6c59-4658-938d-1802ffe90b84",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nugr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nugr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aec7ae21-c229-4bb9-b736-6332e5063fe0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nxjg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nxjg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d49eb37-6f88-4962-b408-a962239604c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nyyu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nyyu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f3a2580-9b7e-4cbc-b3e0-9693733affa6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76nzgm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76nzgm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69fef275-82fa-4697-8cc7-c864b08a8e10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ocvt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ocvt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed308f58-0617-4b41-ba84-817d7134d916",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ofiu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ofiu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23d27b57-3296-44e0-a3e4-982486dc5b34",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ohet-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ohet-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d65c9409-7c81-448a-a268-eb794745c599",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76olyu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76olyu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14a2f902-2aa8-4fbb-af0b-5fd5319d6d1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76onir-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76onir-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f293058-ff0a-42c2-b7ab-230f66a6aa40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76onnd-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76onnd-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62667f0a-7c44-47e8-bff5-de0d5720d462",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76oobh-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76oobh-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b0180c8-00b7-4bb3-ab3c-3993a7ff83dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76oppi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76oppi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--218f1678-b1a3-451b-9722-4afc5b672fc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ornc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ornc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee6f0ee5-7095-4a95-b940-13d4e5124fdb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76osoi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76osoi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8c5cf3d-31f3-4b31-b223-d02a1cfbf43e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76oubd-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76oubd-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--580afe10-f7b8-4ffa-93f9-fe22abdb1380",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76oyli-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76oyli-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4685f95f-652b-428a-a737-1ddf53ee462e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76pfbm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76pfbm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fba7423d-b966-46af-842b-c8b3f77a6f37",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76pfby-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76pfby-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4c2a6f9-b6e6-471b-9547-adad6430ca7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76pggt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76pggt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b017a354-2932-47a5-ac25-c37bdd668e9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76phfy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76phfy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff6b570a-a682-4ffb-ab8a-a128332d0bf6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76pjbo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76pjbo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24c496c6-6171-495e-a2dc-09eb21786a01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76pnln-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76pnln-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0efce2a-94ec-4ad8-abd0-8427060ac3ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76pyxm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76pyxm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea27a176-3592-4d2f-9edb-8b03ad9e4a16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qcbp-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qcbp-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--923ae5a7-7817-4f27-8755-463d226c95dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qdqo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qdqo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1169a157-2420-4690-bbac-afca24307f16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qhru-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qhru-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d593660f-0697-4af0-ab5c-f4ffdc87badc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qqij-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qqij-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a534be7-079a-4c97-bf1a-2d5a2047386a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qqut-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qqut-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5b6bc8e-5ee3-4857-8586-3118cd1e390a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qyow-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qyow-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a1d787f-e96f-4172-9e5c-67e85e6ab9be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76qzpv-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76qzpv-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfd5bc7d-8f43-4540-8b9f-3fb7dd6f95c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76rcft-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76rcft-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9fdd28a5-17e1-4e7a-a506-e0b40023c7af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76rjcp-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76rjcp-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aad68073-8e82-40f1-940b-fb6b048a20c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76rlrn-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76rlrn-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a9705df-bad2-49fa-ac14-fb4fea2c24b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76rrji-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76rrji-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c07d45d0-d3c8-46cd-995a-add79ce79e92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ryfn-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ryfn-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fad8cefb-76fe-4252-ae2b-7fbbbeb88cdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76rzfe-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76rzfe-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d053840c-865b-4708-bc80-51a45964ed7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76sggr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76sggr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5168540-d526-40b7-987e-61819b6e65c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76sjss-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76sjss-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56d6b9f8-a90b-471f-b73f-20f008624ace",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76smcq-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76smcq-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5f44c6b-8518-4c12-b414-4122b3fbbd8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76sowr-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76sowr-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0780059d-fd5a-494d-aa64-64a4f2bf2319",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76sqmi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76sqmi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47ed2a20-f2f1-4f19-8394-ded217daa422",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76sthg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76sthg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--881e1c53-42f7-488c-a7cc-bc307c97eec2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76stsa-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76stsa-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98845435-4619-4608-a836-5cba4dbddfc9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76stzy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76stzy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97979db9-741d-4449-91fc-2fe5a8529200",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76sxjy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76sxjy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cb9131b-9092-47d9-8bff-39a0e23b67cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76tbiw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76tbiw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82832d83-268c-4c48-ae86-c05faf4f36aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76tgbg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76tgbg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4e289bb-6bed-4576-899e-6ccf3896134d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76trqj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76trqj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5d9cca3-5627-4864-b76c-fe2c90e666fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76tvua-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76tvua-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a59ceca3-0c9f-4641-95ed-922c52f0f3a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76typb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76typb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ec76406-04c6-4578-a25d-c3e4eedcb2e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76uarg-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76uarg-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8da39caa-ca5d-4602-a905-10b4fe53712e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ueqw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ueqw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38d835a6-da57-4973-bd3f-6b1ba85ebf0c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76uftu-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76uftu-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--934e758e-93e9-4b54-a7b3-769fabfd24e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ugim-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ugim-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7d7aad7b-0b54-4961-ab90-7420a3279e0e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ujqo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ujqo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a142eec-ae3e-44c4-890c-0fd834a6cada",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ulrp-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ulrp-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a54dc695-4480-4daf-9476-bf0174a6bbd9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76upnt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76upnt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ef97c09-b3a4-4f77-9619-f02687f390fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76usmy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76usmy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d6a8827-ef87-4caa-8ed9-d2938a7f72b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76uwdx-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76uwdx-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60a16170-255f-41e9-a90b-37fc496f3716",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76uzmt-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76uzmt-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffff9c67-310a-4f9a-a909-af072229941c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vaee-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vaee-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f225c78-a44d-4a51-8c11-b3b715555f2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vfqd-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vfqd-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1f0ebe2-146c-41fb-92dd-98d245077b27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vhjo-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vhjo-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47d932e4-3b63-4b18-a93a-816b813b2424",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vint-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vint-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--767b8070-09f9-4c79-b8ff-4c51658d3e8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vlwy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vlwy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d669005b-1328-4797-975e-048493fb542d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vqqy-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vqqy-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9a857cc-cd05-4788-971e-f39ba9436a5d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76vykv-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76vykv-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cf954ce-2b4f-4a44-aa0b-cc3aafec15d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wgmd-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wgmd-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2383daa-ed66-4a9e-8201-ce0cd0f1a89a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76whod-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76whod-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f1dcbe1-1f51-452e-a72a-af4042798c33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wims-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wims-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b822edd8-be14-46e4-9fdf-9c4e19d9e932",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wiqb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wiqb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9133db0-ec67-42cb-9896-9987ac14b2a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wkpf-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wkpf-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74b06272-abf5-4490-ac55-f2f3a3f23c9c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wmuq-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wmuq-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6dd5b569-c66e-4f7e-9be3-659de196dcaa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wnpi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wnpi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3b700a5-0d05-4073-afc1-e0709417e3a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wonc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wonc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18ee2723-77d9-4b6f-be26-56fdd8ef76ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wraj-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wraj-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75e1dd69-2e68-40b6-9330-45f244e2227b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wvzi-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wvzi-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b38e5a04-36a6-451f-ab43-c8b4c938d616",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wwtc-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wwtc-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e6988a0-6efd-433b-9c69-19877b726204",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76wxff-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76wxff-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--390e8eb4-b775-4b17-a30a-ecb6ca53c55e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76xptm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76xptm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5383eb4-e61b-4746-b7aa-8740b107caeb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76xqvb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76xqvb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9903709-7cec-43e0-a3c7-9616181edbbd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76xwda-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76xwda-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--286c6409-6092-4fcd-a423-2f9f452ac2e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ycez-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ycez-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de26f818-6eb8-4524-b4ae-01c4ded4ef67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76ysec-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76ysec-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a58ddc5-446d-4cd7-9dee-25fd84351aad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76yyzm-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76yyzm-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8618e0db-378d-43f1-b623-6a6213501149",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76zcwb-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76zcwb-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--072f6b27-4802-44bb-bf73-bcca3abcbce9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76zdhv-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76zdhv-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7dca0458-afaa-4e0a-84dc-adfc30a6d20b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76zfbq-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76zfbq-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--777776f2-5961-4d67-b4ac-04a297f8635a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76zffw-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76zffw-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79d06c46-7a54-45f7-987a-a24b6407efb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 76zfwn-fifa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '76zfwn-fifa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ca1e3b9-a6b1-493d-acde-f4d880c96ac6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7716.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7716.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82ad7dda-073d-40fd-8636-9921546c9941",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7731.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7731.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79666568-7baa-4b22-8ec3-811f3064f22e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7745.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7745.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a246777d-1758-444d-862a-3619c21a86bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7765.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7765.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c511977-acb1-472b-b24c-bb6d2a3167e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 776617.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '776617.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25305897-36a0-441f-b866-f35fc2b81c9a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 77878.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '77878.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--369e5a54-f63a-45f7-b5a4-5aab120ecd7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7789.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7789.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4de593f-cc22-4d1a-b49d-58b3656fb976",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7793.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7793.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18176de6-5463-40c6-8188-a44256455946",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7800.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7800.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a7c7a2c-90b5-4f08-987f-9fedf220ca53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7842.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7842.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8dd50663-1946-4b5c-a7fd-9efdfca033bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 78526.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '78526.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3f55bda-056a-4df6-b816-86cfee7340e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 785503.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '785503.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9727c6f2-5003-4b9d-983a-0b09d30693a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7873.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7873.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44270e5d-9d53-4e53-b5af-cf5bd6933600",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7883.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7883.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9654de97-6059-48fe-b893-627bf64d2244",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7898787.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7898787.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8f5ec20-6704-4922-9864-0266a0e597dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7902.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7902.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--790b131d-4fd5-496e-a24a-5ad95a374400",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 792387.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '792387.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c8ca572-640b-46fc-9ac2-768b2474aeab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 79261.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '79261.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0ed88eb-40ac-488d-93ac-420e4a10a15c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7949.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7949.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--157d5c5f-1800-4de2-85ba-3a7a09caf78d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7967.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7967.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79c603df-f8a6-48ac-9173-a7bbc8ace091",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 797581.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '797581.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5947b4d1-e206-415b-9aed-64b3c952c35e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7976.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7976.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eacc214b-a3a0-4c89-99b8-b2e80faaa98e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 79asj3i.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '79asj3i.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0627ccff-5400-4397-a909-af920573174c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 79s3sgp6sx.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '79s3sgp6sx.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34ecf3be-bf4f-4e2e-8750-7dea83c58b22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7ascsgp9ss.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7ascsgp9ss.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0697482-4196-4a9a-b5dc-6da3a7492dee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7c7esgp557.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7c7esgp557.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9402d37c-0a22-44de-b517-b9359aa9ea7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7cbasgpcf8.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7cbasgpcf8.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b0b7d9d-6b0c-436e-8b9f-5f4a3be9d01e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7cxe91o.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7cxe91o.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69a53f4e-2614-4a57-bf11-261a7376ebea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7d6ssgp9s7.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7d6ssgp9s7.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c20044e2-68f6-4c14-a285-045ea9294a38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7dw.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7dw.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa0a96c5-4904-4359-ad2c-e19b6a15be6d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7e4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7e4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--702ceddf-316d-44f8-9d14-652c39d89c03",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7eb.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7eb.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e389144f-c7de-44ab-91e4-3bce1377fbef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7f213z.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7f213z.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e10ce90-ef32-4100-9cc8-a0198b362215",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7h3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7h3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a160874b-d146-420e-8679-f792fd54b6a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7hj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7hj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc08a9f9-329d-4bea-8be1-9c93542ae169",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7hp8dfi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7hp8dfi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a87c9c00-f85b-4653-8bca-64d316bb59f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7hqxufb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7hqxufb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e341d7e3-b7c4-4c78-a82f-bfebda4ccf4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7j8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7j8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3fca1cb-f356-41fa-a0ca-b331d1aca711",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7jz1hze.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7jz1hze.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e263ac8-f33f-4ef8-88a6-d40682b483b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7k-casino-8ovmc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7k-casino-8ovmc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44881ec4-fd0f-410f-92a9-16fe3330971d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7k5te.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7k5te.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b264aa94-e7fa-4924-b8a1-010c6c22ac7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7kaz7s.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7kaz7s.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d83e1d3-19e6-457b-a43c-8819a956d2d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7kg6oa.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7kg6oa.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56440ea0-a877-4f7b-8e9d-91a0bb3b6a18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7meterrtpmaster.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7meterrtpmaster.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c99d2151-2bb6-4f99-b74e-e285411e9e16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7mmbethkwn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7mmbethkwn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95ccc52a-e318-4ef5-9932-8c8def9d45ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7nsa69r.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7nsa69r.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d9d98e6-fa1b-4e19-bab1-4b3c639445e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7oz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7oz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3af6db49-6805-4527-b8a2-12ac55fc5d10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7p3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7p3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27aecf0a-c1a1-4b4a-9cb3-022b859047a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7q8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7q8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46b4aa61-e43c-4f2d-8f47-df4d24afdaff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7qb.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7qb.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89ec2d67-f6da-4048-9ef8-b206b6564669",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7qt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7qt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f9ba39c-befa-481d-a385-52ad7e543f32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7rn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7rn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e400661b-0825-4efb-a5df-ab44b0f510a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7sx.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7sx.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62400aeb-8e58-48e8-9225-0613d9bef0c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7uh6q20chps-5vbchai.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7uh6q20chps-5vbchai.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--962448a0-2dfc-41d6-ad46-33bde722ca09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7wryo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7wryo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4dbfbbcd-3674-4d22-806d-aa3292d5c50e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 7xewqnauzo38ij5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '7xewqnauzo38ij5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3541f957-4acf-4e05-9218-805d24dd7cac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8000.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8000.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--882fa397-b75f-418b-95fb-b762fe4f1f58",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8018.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8018.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b668b21b-ca2c-4a65-a6b4-842c0c041908",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8022.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8022.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c819e035-8baf-4fd8-acd3-e9c810ad72ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 802726.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '802726.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7310cd18-e116-498b-855e-16f3d635ba3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8028.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8028.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4aaac0a2-45eb-4f7e-b2ec-8f6b271aa903",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8031.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8031.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9df91112-c94c-4455-8658-8c0ea528b507",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8039.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8039.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f4232c5-9ef7-40af-abd9-96f98167ea18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8053.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8053.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b184180-892f-45f1-9f4d-1a2b83fb2fc4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8069.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8069.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83b29e6d-01e9-4560-9573-b30cf3b47c9a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8070.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8070.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--559cb846-6af0-42fc-8689-dfe203379b0a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 80726.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '80726.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b865ade7-006a-4e24-badb-7598d60f00a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 80756.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '80756.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32d16248-67d7-4836-9ca3-560516436c0c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8085.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8085.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a1729010-2124-4965-add4-5ebafb4bd15d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8089.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8089.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f98154b-e7ff-41f1-b845-7447ba8cca87",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8095ele.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8095ele.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3443642c-280b-4aa5-bf86-2e136e33806c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8104.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8104.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a90bbc30-9570-4f1e-a011-516a1a890c6f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 812711.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '812711.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1fef8a2-e484-434f-82c9-a3d4e1b0c649",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 813158.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '813158.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffe8712f-ba13-4ef8-a562-9e7f922f8c99",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8147.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8147.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--155dd147-1abe-41d1-bd6c-cdd1eea2551d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 814a1v.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '814a1v.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cd7ab7a-ae4b-470d-99c3-c9bf019b0668",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8158.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8158.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92f67e6a-9456-423b-bfaf-edbe60e27edd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8159.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8159.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b78c3b0f-9605-4dd2-b301-1bf74848e5a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8186.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8186.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--675e3add-2d52-4067-99ff-6a06c8e0b589",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8207.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8207.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a77a0fd-9474-40d4-b8a9-eccef1558d03",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 825217.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '825217.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d36f072e-ae37-4761-97a6-410e759f0d77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8297.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8297.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5def1d77-64ad-48f3-b7da-f5959169cfbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8300.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8300.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a21e216e-6dc2-4f64-99fc-621707d7691b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8317.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8317.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2caf51b4-e227-4436-940b-99acbe100013",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8321.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8321.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f3ccc3f-799d-4b8e-871e-b8a952d7084f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 832531.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '832531.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e50d4569-4244-4b31-ba46-3ea8fa162904",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8326.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8326.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1e6ffc3-43ea-4e15-afd0-c5b15422acfe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8329.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8329.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91bc6ad2-cd52-4fc7-a3b3-3d00008be9fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8341.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8341.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d176b519-4f61-4f0c-8b77-de755c9a281c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8346.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8346.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7c868d7-cd58-40b5-b198-be69dde204ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 835825.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '835825.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd0a040c-f1de-4ea7-8fe8-908c71d2c517",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8374.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8374.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4878ea8-114e-4f03-8a29-7304354e350e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 83f4w.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '83f4w.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89d277cc-fe1d-46d8-8886-f44296cd0882",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8417.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8417.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c4c67f3-08d2-408f-ba9e-f28bc46ab2f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8436.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8436.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9030e744-d2af-4db7-b04c-5d32fe62a065",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 84622.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '84622.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efede639-eb93-4fb0-9812-ba0f5fae088e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 84655.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '84655.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--054b05a0-e599-4a89-bde5-04824993d965",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8470.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8470.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97701f2a-80ed-4263-9761-b8b31c08e9d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8476.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8476.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35e07272-68b0-4c6a-b2ec-c75c15f0c92f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8521.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8521.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7658eeb3-26b4-4a78-97be-9efad4ccd56c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8560.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8560.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--389d98c8-740d-402c-a2b4-c30d0da36804",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 856316.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '856316.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44769812-3823-4e62-817c-b519ddc2bcd9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8570.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8570.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21e27566-c048-4604-9c52-a4697be0cb4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 85a8sgp37b.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '85a8sgp37b.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fccdb76-8d98-4024-ab30-32d82a1278d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 85e.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '85e.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7aae825-8758-423b-aab1-50225582fb70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86071.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86071.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3107d8c8-ad1e-4531-8dc3-ee606b30e755",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86073.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86073.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0029ac3-4894-4745-b533-ed3c31d6129a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86074.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86074.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--daecf9bc-9811-4fb0-bec3-e33a5d9f8f7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86075.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86075.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71bcb0b7-fece-4280-bca3-f379b3373cca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86076.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86076.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--daf52bf2-cf9a-4dce-a21f-952847ed9544",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86077.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86077.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--303eeaa2-9bfc-4c12-934d-21b39b4bafae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86078.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86078.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2e266bb-2c3e-40da-9f70-de67e78dc917",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86080.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86080.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57822be7-afad-4f51-ad00-3750386a13dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86081.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86081.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fce00e73-67f9-4b4f-9958-4bd3118d98c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86082.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86082.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30ef9426-5e49-4e7c-b4f0-b6d3d4818182",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86084.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86084.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--decc4f14-6d81-4e0c-b42c-ad1f312056c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86085.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86085.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcb7e04d-2d89-4770-a723-67b92a70bc36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86086.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86086.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0bf1794-2d7a-4b7e-9fdc-748fc37648b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86087.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86087.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--851dd3c3-39d5-472a-b492-9b5602f6e7a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86088.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86088.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7970c99-3bd3-4b4a-933a-8655272b7ac9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86089.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86089.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bb81bf5-6c4a-409e-b9b1-ad0c65f18eeb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86090.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86090.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34d88323-3691-4a71-9644-52bb32ab0f67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86091.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86091.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8fe07fcd-889a-4a54-824d-c4875e4fc240",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86092.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86092.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--172300ba-5ad5-44b0-91a7-3ed52ab7c0de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8622.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8622.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e473d89-58ed-4feb-b316-90254d7b9323",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8673.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8673.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3f0f132-867e-4600-8a6d-2c3be93faf00",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8685220.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8685220.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8200e8ff-3e68-431f-840e-9074f4d9bcef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 86g.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '86g.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--778509a9-7885-4e58-9de0-dfa7e3759de9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8704.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8704.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d0a9714-93d3-42eb-869e-a692903cedaf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8705.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8705.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e3e9294-11ee-4c48-8cea-f4bb67625a29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8707.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8707.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2dab58b-5b3b-4406-8b1d-ee14518e147e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 870xe8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '870xe8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff8a1f97-e1ad-4862-8f82-8f5b86d42429",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 87567.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '87567.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7dfa4280-b548-4a07-b447-675931f1eafd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 87580.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '87580.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96edc688-6f1c-45e1-a127-cc1c1e79ac62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 877384.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '877384.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efcc2a06-649d-4aae-bfd7-95908fae2989",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 877660.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '877660.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bf64339-9091-4d65-9f0e-3e2e323d2756",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8782.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8782.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f65007ef-18ef-491e-9af3-b826a2fe59ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 87d4bc48b3b8d5afb6ddee6441a4d528.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '87d4bc48b3b8d5afb6ddee6441a4d528.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed491afa-7adb-4b0e-aa2e-0d0a15af2844",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88575.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88575.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d87f750-7d70-4980-9744-342776d423b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 886509a1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '886509a1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e4709f4-ca63-4ca0-88f9-9d414e5e8f01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633a1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633a1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1d26bf6-9bac-4424-8795-520c3438977c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633a2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633a2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--246caa49-c80f-4748-87c2-7c106f163209",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633dh1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633dh1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1b59a96-c5af-45ff-b4f8-4f51464cfaca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633duankou1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633duankou1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a63747f-a41b-42fe-b2e0-7079ab1ba8fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633fanjx1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633fanjx1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--240f27b4-ea94-4d8a-b216-8c8ebec48947",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633tz1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633tz1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b7154fd-24bb-4e38-aedc-ec7cec53fef5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633tz2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633tz2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--271ff26f-bc55-45e0-aeeb-a055e6150f7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88886633tz3.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88886633tz3.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22785e8a-629a-4743-85bb-d82a65889adc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8888966.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8888966.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb632570-8b0f-4165-bc73-ccb8c3d65df6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8899870.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8899870.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13d9104a-a78b-43a4-b91d-c9c0563fa3e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 88cassino.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '88cassino.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc56fb88-b1c9-4a48-a55f-2fbdf5522e13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 891633.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '891633.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--776bafab-a294-4e3a-bf35-232ea4a578e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8918.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8918.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54bb706a-fd17-4888-a44c-cb6ae4d23138",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8987.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8987.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--000e6c49-9b90-4050-8a3c-11ff6cc9e37a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 89c.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '89c.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fcbd2bd3-0d5e-44f2-ae6e-a9a38bf79f48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8a1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8a1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12468937-b794-4bbf-8c4b-6ab71b3d3813",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8bbfsgpe47.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8bbfsgpe47.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a315545-12a3-4648-9d21-7d0c3d80ded1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8c5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8c5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7882cbd-650d-43e6-a36e-34be6b1bb0d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8d1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8d1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--94004a33-f9a8-4986-84d2-d7ebd6138872",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8d8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8d8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--236b4ec2-702b-4dbf-a8d0-13bfba80e9b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8e6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8e6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f32f498-95ba-491d-9189-847e7d5160c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8ft2hms.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8ft2hms.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0a6340e-0c8a-4b19-94c8-e7d68fc93b01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8g7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8g7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cb08945-0318-4ed6-ba4f-dd1a9666f8a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8gs.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8gs.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee10d7dc-3dc8-4927-aa24-e1e3a6c8b621",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8ho2ie.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8ho2ie.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8663e0cc-0ffd-4d0f-90d7-30434a2ea2ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8k40cmu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8k40cmu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16914d34-6011-4f76-9854-1f7f9826c440",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8k9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8k9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cd6a46e-2837-47fe-86d5-a68d055c092c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8onzl3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8onzl3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--460f7e6f-7258-412a-bfee-1be22c3053f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8pr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8pr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4941843f-e6c7-475a-b6f6-4eabb076f28c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8py.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8py.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--edae12d3-e449-4cd3-b5e7-f6235966963a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8s4iocta3zt5jo6.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8s4iocta3zt5jo6.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--731765d2-6ead-4327-af7b-66c0c50f2044",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8vcoyts.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8vcoyts.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a31519a4-99e9-4b07-b093-2f7b9f82a891",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8wa.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8wa.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41a21cd2-3fad-42ac-a71d-2899ba844f5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8wflcq.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8wflcq.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a623c748-ae6b-4162-9693-6ba67cd95bc2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8wx.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8wx.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b85ac32-12cc-4382-9f53-312eeb635ff3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 8x1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '8x1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e558265-263b-4999-969d-49f7a4b604cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9-6kim09928866kvj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9-6kim09928866kvj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b797ee71-f20a-4c92-b4dd-0292fbcf7120",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9011.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9011.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c49c605-6575-4c27-aed2-f8d51c757b9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9018.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9018.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b464fa2-f38b-4958-808b-993f17ab3ca3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9022.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9022.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d6d19dd-a268-417b-87bf-66a6895bbd7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9035.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9035.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--977c43e6-27f0-404d-a588-30a539430203",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9048.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9048.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fbf1608-f753-421b-8680-8c2b4bcd95a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 905326.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '905326.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--768bdf58-af22-4c04-b8d7-f004cc3b3330",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9058.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9058.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b268fa6e-45e0-41fa-8b45-a9de46fa2553",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9059.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9059.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f6be8f82-d40f-400d-8b68-589205d21031",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9060.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9060.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc586b5d-0579-4d61-b292-0c7638871ce4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9073.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9073.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5ee2d4d-3e2b-4e26-a508-1e4fcc76f768",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9081.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9081.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa15ff9f-102e-4bb8-baa6-a8ef082d2144",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9101.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9101.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f936ecf-13b8-4b33-b215-0705dd13d05c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9109.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9109.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77eef5aa-9335-4fd6-9058-c1db24e028e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9130.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9130.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41c53c42-45dc-463e-9efc-39ab79564155",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9175.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9175.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3d1b83e-1da1-424a-b79e-caaa7521dbdc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9214.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9214.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6410d0b3-c0c6-41d5-bcd9-96ab331e30a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9224.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9224.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1b48584-e048-4022-b763-33ffb230edd3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9240.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9240.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80424884-4e1d-473c-8a99-a2ae9e4b3bde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9248.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9248.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bae5a0b0-eee4-4a2b-bad0-dee67acc621f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9252.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9252.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db167f55-4352-484f-8bad-5461febd8875",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 92697.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '92697.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b5e60ea-50b5-4073-84f2-226452be6b1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 928867.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '928867.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7793da55-79ba-4fbe-90d3-395d50f2469e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9321.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9321.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51a48486-d092-47d0-920c-f2a4abaee02a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 932160.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '932160.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a6f21e5-e4a9-4881-8f8c-3fbc3b172a5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9329.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9329.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6de83c2d-23fa-421c-86d5-74e349e3f010",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9332.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9332.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64797366-5095-4229-b582-32ae309f0d5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 933csgp5b4.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '933csgp5b4.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e50dc616-7781-46b5-b68f-51fda86ffdf6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 935887.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '935887.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--054e1498-d38a-4b47-b5c2-ae98c509c26c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 936026.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '936026.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e09ea872-35ee-4ade-8f4d-720893f1abd5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9376.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9376.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab1cffac-f837-48fb-965d-0890e2761f68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9384.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9384.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--853bbd49-2a82-449e-8c2f-763ae339e197",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 938923.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '938923.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ccf6dc07-eb1d-4c31-ace0-3eeccd3567ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9421712363294.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9421712363294.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--723534a2-ed1f-42dd-a854-ca99e78a5535",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9438.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9438.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3c9ddd2-aa0e-4fe9-90d8-28d60d3260ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9443.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9443.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33c1c82c-04ba-4d77-bd2b-e1f65fa097a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9457.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9457.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ddd217d-bb25-4c53-8983-45d433a9e067",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9462.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9462.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6b8302d-989b-485b-9069-596ccd3951cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9463sgpefa.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9463sgpefa.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d70a68d3-c111-48b9-9eed-a3bb2672f257",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 94679.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '94679.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ae0386d-d62a-48aa-8f45-d6bd338a1c1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9480.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9480.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b434b692-25de-46d8-be57-732d04adf7da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 94n.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '94n.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0885b65-776b-4177-bcc4-a5a508a6475d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 94w.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '94w.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bc4e493-ccee-45e2-915b-30e4ac752c44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 955bsgp835.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '955bsgp835.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6331a31-8a2c-413d-a561-ebdf1bb5ccba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9573.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9573.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b463574-4252-4cb1-ac59-e1b7cd82ac04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 95s.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '95s.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8d7474c-f4c7-4f9c-bfdc-f4fd11928b94",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 962152.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '962152.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56b55e90-76b8-493d-9895-6b34034c9dd9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9639.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9639.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d59235b-e64e-4457-a63b-a3335c958ee7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 964378.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '964378.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93fea2bd-252c-4cb3-bdaa-ed2db0a78d62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9651.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9651.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--932e60d5-ce74-43c7-977e-138cdf518141",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9680zwx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9680zwx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01de4b22-bbc6-42c5-8a89-f7a7eb9976c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9704.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9704.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9b34232-04f1-47e4-ab96-90e100ddd7bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9712.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9712.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f73caa4-fc0c-4688-9880-785664c68ef7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9757.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9757.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cabd4e31-7331-4684-965f-913953178ca4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 97647.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '97647.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b7e2831-bb08-497b-a5ee-e31e8554e6a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9773.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9773.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--686cc88a-9c99-4c0f-b0e7-4f5e237a459c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 977622.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '977622.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8da8c02-03c9-443a-90b8-e453cedb1e3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 980313.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '980313.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f4d676a-2ac5-419c-8966-05a673f59915",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9846.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9846.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fdb87b2e-206d-42ea-bc15-e642260f2864",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 98844.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '98844.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--181caa77-7e17-49b9-a501-ff49440f9172",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9886150.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9886150.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b434d387-8b1b-4b16-b777-cb5e60b92ae5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 989913a0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '989913a0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e2626a2-ee61-44e8-a650-a94e35b35ef8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9933.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9933.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cd98348-187f-4ddb-abd8-187dddd2f904",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9939.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9939.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de1c3b20-21b9-4802-bc06-e15aa6c3c741",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9947sgp95c.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9947sgp95c.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8c84964-608e-4fdc-9bbd-f21859991dc4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 99rsktkdkdvjlqi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '99rsktkdkdvjlqi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c64ed9c-9dfc-40d4-aa75-dc6c76dfb5e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9bo.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9bo.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e7622f8-daa0-4503-89fa-a2cd27a85fff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9d5ng.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9d5ng.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3fd8f8ea-be09-4784-b0b9-02fe8d3a37b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9e0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9e0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c1d4d93-513b-46b4-b0b4-2c0f912eeb39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9e7dsgp93e.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9e7dsgp93e.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b2882b7-5188-474a-8a97-2c7e5d4a5d9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9ecssgpe4d.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9ecssgpe4d.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2599e24e-4976-4ddb-8935-ccc9ac2202a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9exxsgp4x5.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9exxsgp4x5.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c47c739e-adc0-4924-982c-fcc0bf3a8b41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9fd30yx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9fd30yx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5588189-4a18-48dd-bc1f-e00e1f5040db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9fe.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9fe.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d958df9-9a88-470e-b8f9-db235970c751",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9ft2y.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9ft2y.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9bfa47a6-9968-408e-bf59-8aac9b933505",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9h0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9h0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aef62d90-4061-404f-8349-207ca45c4db2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9nkc9.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9nkc9.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51b79d95-2884-43c5-ada3-fef806e5c46d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9os.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9os.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00f591f5-f501-49ed-a68c-86bad10fceb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9qqbhsb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9qqbhsb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7c3e894-d05f-4718-bd55-41615b42df84",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9sh.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9sh.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9ad45cf-1f69-4f09-8481-d9da4fb55165",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9tz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9tz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98b7669e-b3c0-4f91-817d-23be0a9d3c4f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9uw.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9uw.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--335d421e-827c-4c3a-b7b5-f596cbc64323",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9ycloud.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9ycloud.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b762a988-30a2-4fab-85e8-f174ac9d6ec4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9za.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9za.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f57f25ac-2c65-4415-89b4-3f7e3d23b4a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: 9zy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = '9zy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5feba7b-0206-4466-ba47-eb04768bbc10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a-ofeta54354.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a-ofeta54354.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45549588-880d-4144-9239-6ecd64cab7b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a0k.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a0k.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e18fec8-5f0c-4de0-be14-d6f15bed376c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a1a7q3a5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a1a7q3a5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83a16d93-0985-417f-982b-4b11c9be64c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a2d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a2d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ec11772-f4f6-48aa-8b56-305aba817b45",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a2u-demo-app.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a2u-demo-app.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15d48398-9511-4959-be89-b796f19d9ba5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a37csgpfea.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a37csgpfea.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81776f62-4bef-402a-bdd8-11518fa3c122",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a3rvhnp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a3rvhnp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f5a8915-8e3e-47aa-a562-8665734fcbcc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a6o.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a6o.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3f8b073-d373-4d8a-a378-6c5399698eb3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a7s8sgp454.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a7s8sgp454.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc4bbffb-5381-4add-959a-fdcaba7f1b2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: a7se28.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'a7se28.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7f4ac2b-d957-4063-b558-826c60cb6e05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aa8xgl.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aa8xgl.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8055d028-cd53-449c-a697-c9efead482cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aaagame.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aaagame.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be665a7a-9983-4adc-8417-b9c3818a7ba0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aaradhya.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aaradhya.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b4ace10-d470-4c75-ab39-4523daff8456",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aattsurs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aattsurs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62df4660-6bb6-47b1-a7dc-21c5426b6d96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ab7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ab7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08308202-d7c7-47ed-8dda-910616fad07d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: abaszkotak.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'abaszkotak.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--655f89fa-d6c6-4740-ae60-1dc8807b0399",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: abc33shma.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'abc33shma.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de05e608-5fa0-4dfa-927a-e731b1464a28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: abdelrehim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'abdelrehim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--706be782-e172-4069-bbd1-bf4f22dfed4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: abejfknnn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'abejfknnn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--898ebd5c-177b-4485-829f-7b17807bd005",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: abndi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'abndi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a37e58f-ed08-4af2-853f-91e59a7e2b93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: abonnementbereicheverwalten.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'abonnementbereicheverwalten.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf4769b5-876f-4d98-bffb-5cad9f910947",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ac66sgp262.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ac66sgp262.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4a4b5c6-5f76-48eb-86b5-95a026a4be15",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: access-accessboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'access-accessboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec036b77-1ace-4ac8-b402-246525eb16c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: access-boost-winonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'access-boost-winonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7cb74d19-42d9-4f84-a610-91e570ab0272",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: access-boostoutcome-kz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'access-boostoutcome-kz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99b4ccee-7135-49b6-9edf-21aecbf37860",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: access-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'access-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cf9706c-d932-45e1-b0eb-43c0f1da43b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: access-kz-boostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'access-kz-boostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f02e2d56-c071-4782-8f02-e2162a38dd9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: access-kzboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'access-kzboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52e20e59-b021-42c8-8fda-cabbae55c8ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: accmarket.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'accmarket.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3722ecea-345f-445a-a5fe-2e6f2b06abfd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: accordajus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'accordajus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d993f76-4430-40c0-9d0e-fd23cb853109",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: accordajust.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'accordajust.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7d90e8c5-13d1-4fab-a6f9-015103f8fc46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: accountingaudit.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'accountingaudit.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4586bfb1-d274-4dc2-9e67-6d3676134492",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: accountsbrex.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'accountsbrex.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7db85c80-addf-465a-aed9-d32de33de7e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acctcontrolpro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acctcontrolpro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f166140e-cf01-41d8-a2f9-98dc84a9a9ab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acessoriaebdigital.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acessoriaebdigital.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4dcac2ea-c345-4d84-89cb-c61407c5be7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acessoriasegura.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acessoriasegura.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ed92ddb-623b-44d2-8c99-e8b10f8e0f02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: achieveexecguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'achieveexecguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8c89a3b-b286-4b97-9168-72729845d1c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acoupada.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acoupada.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ead6d2d9-7b28-4597-b41f-4599df55d954",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acpmwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acpmwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cbd90b1-72b3-4600-a0c6-ab1350928ae0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acreakkolas.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acreakkolas.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--514cc12f-1b32-4a41-9030-3e90384889e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acthwle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acthwle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3aff546-9433-49a1-b05c-5a25d7bf6db3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: activeersplitterel.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'activeersplitterel.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d469261-fc27-4a90-b5c6-ed343292af09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acuerogemx.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acuerogemx.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18fd3dae-fc1a-4f01-a4ab-0d224053d3b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acvlwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acvlwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63e43153-deec-4b0c-bf82-cc4a891b18d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: acxthle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'acxthle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05f4f785-7d90-4d65-a720-71f78a2b9c06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adaptivelighting.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adaptivelighting.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3fc29fe-3739-43a6-9460-51008a87835b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adbvio9.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adbvio9.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a66da30d-244f-4a80-84ce-917e99b90f5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adderassal.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adderassal.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a3005a9-3ba2-4678-8fec-3a11f7073126",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adeng.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adeng.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af47318b-d7be-43e4-897f-7babc1878b90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adgrowx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adgrowx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc91c027-e0c6-434f-a35f-f1fd27c3ae27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adlaunch.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adlaunch.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f242b85-22cc-4783-a07c-7ee918760573",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: admissionsg.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'admissionsg.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f300c80-4a1e-4016-83c7-c30a69c53d31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adscalex.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adscalex.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cc6c13e-a5e1-4e9a-83a4-aca15ba02af3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adsprint.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adsprint.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1339b5c3-6600-41ac-bdfd-604ffc5ac76d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: adultskillpath.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'adultskillpath.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bad211f8-e112-45f9-b18b-f427428a4c0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: advocatecourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'advocatecourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed35cce4-f368-4884-9b98-a97e10f6868c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: advtaxstrategy.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'advtaxstrategy.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1618d193-8c43-4858-b496-a9cba60be758",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ae2642fox.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ae2642fox.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57a988c2-9fc1-4ad4-bb8e-c643a43036d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ae2642fox.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ae2642fox.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12a4fc19-808b-4c07-9d81-5a064ada8e5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ae267sky.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ae267sky.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eead0998-4ead-433a-a31a-1cb48453d5f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ae267sky.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ae267sky.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a5fce74-d73b-40c2-a698-fa6ffc00267d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ae268sun.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ae268sun.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--da432573-e60f-4620-9da9-2f1ef1a6cabb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ae2699cat.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ae2699cat.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a953d008-32d8-422a-96b4-771bab439609",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aexpzsiwems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aexpzsiwems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5adf1162-05be-4e2a-a61a-3998440aaf3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: af410.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'af410.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99dbd87b-6521-431b-b106-30cedab99a88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: af94sgp26f.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'af94sgp26f.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75dc8a68-1c4c-4de8-94f0-d8431690d365",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: affannaushad.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'affannaushad.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7765c20a-19b8-42a6-b85e-961647764425",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: afonya-tv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'afonya-tv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--349a2566-87be-476f-9884-ff428295f55e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ag-wallet.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ag-wallet.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cad562ea-e9b1-40f7-895b-0b779a532a38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ag5mrl.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ag5mrl.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b24a317d-27aa-414a-952e-4fbd78cf7d04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agatakopec.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agatakopec.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4a611ef-0b1d-483f-bd56-cc66bc7b808a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenciatributoria.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenciatributoria.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9479c575-7e24-4736-9d07-710fb6762417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenciatributoria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenciatributoria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1737dc4a-c4ab-485a-8bcd-8fb8387a98b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenciatributva.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenciatributva.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9e00cd32-a5b2-4495-a118-e1ef2d266589",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenciatributva.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenciatributva.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--172dde19-2b21-4f8f-8eba-e6f186ee5bcf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenciatributva.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenciatributva.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c6608d5-cd7d-4ec1-9b65-7c4c38f683c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenciatrributa.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenciatrributa.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f52b3950-2651-430c-b76b-ff9102131832",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agendacourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agendacourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a8035a1-f238-4a78-8b76-ac48c2c97f08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agenslotsggrtp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agenslotsggrtp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4d28109-76ab-489a-8a68-af3e69d545dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agiszerszen.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agiszerszen.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a0c03df-a72b-4301-8253-a634121f8b80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agnieszkagradzki.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agnieszkagradzki.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07e5f278-9105-4a76-89e4-3e831aa8f3ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agniwinapi.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agniwinapi.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a845bde-0e20-47dc-bb3c-fc455e699e7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ago-workspace.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ago-workspace.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e23c8f0-22e3-4325-886d-a4a829fdabd6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agrcapital.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agrcapital.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--558220d0-9a21-49e6-9f99-13733a36d73b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: agrin4.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'agrin4.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46a50c99-8814-409e-8d57-c375ce32c815",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aha9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aha9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22d0e3dd-d05a-4607-9cdf-17b90e01de82",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ai-chat.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ai-chat.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--245a01d2-cf03-42dd-87be-8abbc4556cf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ai-home.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ai-home.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0fe68661-3d50-47e7-805c-2972afe2804e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aiboldinnovation.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aiboldinnovation.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e8369c6-c2f4-420b-8b45-f8133fc9f9af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aichoicetools.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aichoicetools.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b498abde-558c-4675-ac23-f54f85d38b27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aiconcoin.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aiconcoin.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--089cddae-2138-4314-8edd-9d13f80647ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aidersolution.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aidersolution.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0700483-fe18-46f3-80db-b663621785d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aidevicesdaily.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aidevicesdaily.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--507cf3dc-df2d-4194-80c5-869ae97f8f90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aidevtoolspro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aidevtoolspro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa54758f-c3ab-4f5d-ae22-b7dc4d9eb9bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aidigitalinnovate.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aidigitalinnovate.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--009ebf8c-e9d7-4145-a7f2-9f83761d78cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aidrivenresults.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aidrivenresults.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4eabbd51-5d5d-4db6-a4c3-29cdd4abbe8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aielevatesolutions.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aielevatesolutions.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29ee0b52-3bec-4c06-a572-200c8efb3b5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aiessentialhome.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aiessentialhome.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e38ef161-c518-4a44-bd24-a5a46e3e0340",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aievolutionpros.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aievolutionpros.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b973954-5d4d-4dee-ab20-305b9cbb2ac7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aiflowworkday.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aiflowworkday.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa22faac-97a0-4b7f-ad7a-2754f722558e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aifusionsphere.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aifusionsphere.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--172f58e1-87b5-4814-9f49-6ddf0485e87e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aigen5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aigen5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efb926ad-6b0b-44c9-a13b-0cfdd5d2cec8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aigenuinesolutions.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aigenuinesolutions.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8ec802d-5eb4-4c3c-a41e-27a3b90a8a50",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ailearnplatform.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ailearnplatform.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c0973dc-7135-488e-bb67-d4b9aeb84e3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aini1314.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aini1314.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9110f7c-a81c-49df-8f1c-0dc7a677ea85",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aioptimizetech.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aioptimizetech.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b2d963a-fb65-4a23-ac8b-8b672d8cc846",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aipetcaredev.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aipetcaredev.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4b9a34e-115a-4d07-8ed9-c0cb4ae91ac2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aipromisetech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aipromisetech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84b9eb30-10e5-4db1-b3dc-67cc10ccbe1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aisoftwarepros.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aisoftwarepros.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fea01813-a64a-450b-a9ff-f4c3b9f7b0d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aitechfocus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aitechfocus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b2c9efb-df11-464b-8cb0-2b7bb3372d61",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aitoolguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aitoolguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--baeb797a-8c59-4aaf-bbe1-c1b09f152e47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aitoyskidspro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aitoyskidspro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a607d324-e1d2-4c53-b4bf-6ccac9db6ab9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aitranscendsolutions.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aitranscendsolutions.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bed82919-78b0-4de9-8934-2ad038eec4b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aivalorvault.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aivalorvault.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e807d5fd-7634-479b-964d-8beb2c1bb16e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aivaluenexus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aivaluenexus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1f9b9fa-6709-4c93-98be-398699fef900",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aivitalitysphere.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aivitalitysphere.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--079450e8-2daf-4f77-854d-3a723fb58a3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aiyaphorm.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aiyaphorm.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91f8c5a8-464e-4c6e-bd00-b0fa60802461",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ajaib877lkor.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ajaib877lkor.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39eb771f-f2c8-485e-8781-02da5d2d6182",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ajaib882fgh.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ajaib882fgh.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29eff079-4cb7-4baa-b16d-e0b0c96b1b56",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ajhyse.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ajhyse.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63e42248-f85f-46d7-b550-5b9c38567498",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ajhyse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ajhyse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--439f90b8-987c-4c2f-a06a-9ac9c29300ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: akasi.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'akasi.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ca9a8af-2444-443f-a49f-c23a71d3cd2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aksesmobile.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aksesmobile.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--566f15ad-d979-4926-a7f4-2ed317b240ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aktif-jojobetgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aktif-jojobetgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38c786b3-9711-4012-89b0-67148a1554a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: al-masa.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'al-masa.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04a8b369-451b-4ff3-8d07-4bd86e1e5e9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: al0ji7j4u646pd2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'al0ji7j4u646pd2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5bd6ba6-4a3e-418a-ab45-8e15fc2d39d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alaelyonslotts-nz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alaelyonslotts-nz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8617c4cc-e786-4e44-8e03-b716877b3642",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alamostrategicmfg.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alamostrategicmfg.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eec36089-d9ec-492b-8e6d-63b2b5a81a2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alamostrategicmfg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alamostrategicmfg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2a93a02-33de-4a43-8634-20ae63e10709",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: albergolemacita.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'albergolemacita.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7db2a7b9-9da8-4de7-ae0a-ddcf6078add0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alcoq.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alcoq.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffe7b0f1-2f03-4a73-811c-8fc0978b2f53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alcoq.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alcoq.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7bd6d73d-40db-40d6-ada4-a14896794915",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aldermeadow.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aldermeadow.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07840721-7918-4139-92bf-6be2aa38faff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aleksanderlaskowskikedra.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aleksanderlaskowskikedra.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9a96103-ebda-432b-acad-01977fe6ad44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aleksandradrung.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aleksandradrung.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--003e051f-58a6-40fa-8efe-8219423f7611",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aleksandratorski.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aleksandratorski.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb617226-b2cd-43b4-a713-0c19cbbd55b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alexabeth0kii71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alexabeth0kii71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc729304-68af-4aea-bc3e-648e784d5948",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alexabeth0kii72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alexabeth0kii72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d7a51df-b250-46c0-87a4-903ab622f1f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alexistotoh0kii71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alexistotoh0kii71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37a2a023-a6b7-4108-9429-8216f4e7f6f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alexistotoh0kii72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alexistotoh0kii72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5800b8c4-9158-45e6-9bfa-14a85a4a7645",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aliaispace.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aliaispace.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8838584-cff2-4730-83d0-9490442211c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allanlabcore.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allanlabcore.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--859b3e71-49b5-47ee-bd4f-17a3023a6083",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allanlabline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allanlabline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea207029-1cf9-4a68-ace8-87152465a66f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allanlabsite.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allanlabsite.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc24479e-5ee4-4ee7-84f1-c6956340bc7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allansubmissionsprovinces48.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allansubmissionsprovinces48.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c014e0ec-1e30-45e3-8fb6-80839f869475",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allbwnpeapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allbwnpeapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--489880c4-181f-4e8a-8306-7703c07087a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allbwnpelchq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allbwnpelchq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c89134d-da60-47fa-855c-a48ff3fb178d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alledsjenahq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alledsjenahq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--340d5049-fe18-45d1-97f3-3123aaacd54a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alletricapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alletricapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7cc2718a-e729-452d-89c3-b8395637ef95",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alletricdash.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alletricdash.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f158f2e7-e23b-4994-a0b9-dc755663666a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alletricgrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alletricgrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99606a2c-e153-48c8-b269-47544b8623e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allewhubify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allewhubify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa8cecdb-8f93-4d3b-a78a-00bba9da9747",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alleythingfabric.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alleythingfabric.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--721bb0b3-ca3c-4d05-abcb-91025f3c3475",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allfunneai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allfunneai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9115e12b-a5c3-46a0-89c2-e1dac64aaf17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allfunnesite.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allfunnesite.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e26f4953-7c4f-45d2-811f-fa3ff033bde0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allleadkstar.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allleadkstar.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59195390-5425-4a1e-b42d-888e61679da0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allleadkwnai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allleadkwnai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53a76919-a10e-4871-ad50-746077cd2829",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allmyinfosaccessing.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allmyinfosaccessing.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e221a6f-cea3-4d77-b29b-f8921afa9892",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allnflowai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allnflowai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ef9ae52-bff9-4e19-a5eb-3daf66454a4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allnflowhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allnflowhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32c49d49-c72b-4c3e-ae2c-d5d172e7604f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allnsyncview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allnsyncview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae83f760-c7c8-4039-bdf8-50ab09bf2c3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allocdeoxi.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allocdeoxi.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c2798b9-3e3c-4737-9ac6-f6552137f90c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allrowthflow.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allrowthflow.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf5cd0b5-acd5-4cb9-8e08-ed25a0bbb9ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allrowthhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allrowthhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3efa5e8-d401-4073-985a-cfb41e2b628c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allrowthhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allrowthhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09802558-f7e0-4bf7-b58c-59dad3f132be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allrowthlink.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allrowthlink.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f839cd0d-cacb-4c36-a5e7-7c44c647dc06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allrowthway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allrowthway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bffc26cc-10d3-4613-a4a4-49be828fc2e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allscalehub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allscalehub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a23a8d64-94fe-48fb-8601-a9993a37f403",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allscalelab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allscalelab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--356c6035-d31b-4abd-b2b9-a3f44b715200",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allscaleview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allscaleview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de466a04-d584-4e8d-8276-3c1a61bff5c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: allviralbw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'allviralbw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a7fd3e9-b39d-4179-bfc5-a3bac1bd4194",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alnsoft.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alnsoft.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65a293ed-2744-4fc7-b144-e48274a17574",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alobet-7temmuzgiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alobet-7temmuzgiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b65cb82-a288-490d-8124-ef638d5f8ce5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alobet-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alobet-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d25cd539-a117-43c5-926b-9627ea079b8f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alocaz.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alocaz.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdc5d81f-ff03-4774-b22b-734a4a998f36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alpcdnfu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alpcdnfu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfa7b322-f7c2-4e17-b3f5-a4309674c8cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alphax-ad.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alphax-ad.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--964cc609-f5d9-4e58-b6d1-0f8094ebc5a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alps2006.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alps2006.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbf41b8b-aa9d-4cc8-9ec3-17eaee53ad6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8bea0d9-b0a7-4719-a794-0dd803ff6296",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: alteredacidradiation16.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'alteredacidradiation16.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9407be1f-698d-4a51-9bda-1b6b3cfd7d56",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aluxdever.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aluxdever.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de4d83e3-87ff-4fc7-81b4-851ee4d26ba9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: am-spot-mirror.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'am-spot-mirror.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--869a048a-9e50-4366-8343-cc746668037f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ama-zonvip.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ama-zonvip.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2eb8ccde-4e25-48b0-8462-ecbeebfd6f27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorifsa43.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorifsa43.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4444205-83f1-4825-94c2-5c64a97a312b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorifsa44.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorifsa44.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba7cdc28-6bd7-4f6a-9185-6e91e8a5aae5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorifsa45.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorifsa45.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69b24255-543e-4650-a50a-3b16ac37696f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorifsa46.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorifsa46.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b14a636f-b272-426f-ae13-c3d63c7d3e4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorifsa47.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorifsa47.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fbfa77e-3d52-40a6-b5cf-336dbe7ec04e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorturkifsa37.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorturkifsa37.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a0ab6c2-cc0b-42b8-9e0b-b7e5b175617d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorturkifsa38.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorturkifsa38.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--275e3cbe-442f-4437-82b4-de147f7bfcf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorturkifsa39.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorturkifsa39.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c911e9f9-8457-44ef-bec7-e224a7677e1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amatorturkifsa40.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amatorturkifsa40.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--556a0324-fc30-4e0a-8778-9edc30198296",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amaz-on.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amaz-on.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef0cac13-3974-4e55-b361-acfa8f39e300",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ambheng88.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ambheng88.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1da4f68-99ee-4986-a134-ed706d4e58e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amgbahis-girislertam2026.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amgbahis-girislertam2026.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--567c5ee9-c9ca-4f33-a9db-a34b23a81147",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amgbahisguncellgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amgbahisguncellgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--384d23d3-2c73-4989-868d-6b972dba2f13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amigurumidozero.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amigurumidozero.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0eaa2f8a-df22-47a3-9704-ca4b2de3882c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amirmasali82.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amirmasali82.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a796466f-d7da-476d-a189-242fbd7a228d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amordocevida.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amordocevida.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8842ba1-bd99-4896-be3e-197b67434593",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amorperfeito.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amorperfeito.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1be0ab4f-77e5-4e09-bffb-f911e7008fd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amplif.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amplif.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3840d74e-ba2f-4645-bd65-ec9b4bd01ca2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amplifierr.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amplifierr.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0ffc5f6-3ee6-46b8-9514-9caec4d52680",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amplifsol.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amplifsol.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e79cdfd0-a7fe-41c4-a0e0-e37d40eb03e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: amsunl.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'amsunl.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7c3678b-acb3-4bc9-8979-48ab0d6a59aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: an253pd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'an253pd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c28def32-a120-47a6-85be-71c87b955ec2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anajuna.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anajuna.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0efebc7-681f-4c13-be46-9e2ca34d7078",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ancetta-uaa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ancetta-uaa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01f3b5a6-8553-4de6-9cb2-a8ac2084be85",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anchorencouragingjan22.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anchorencouragingjan22.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e902520-70f9-4ef4-94dc-e490a3e5b99c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: andreapastrylab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'andreapastrylab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a8b13e3-48f9-4fb0-9b17-cb594f4868f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: andrzejbednarzflejmer.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'andrzejbednarzflejmer.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a2ccee8-a116-4233-aab4-6c91201476a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: andrzejprzybysz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'andrzejprzybysz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f78b9c83-ce62-4bfd-8b13-330cb5053f32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anetakuchnowski.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anetakuchnowski.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd9cf9de-e5e8-45c9-be4b-818e6f231cd1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anetamasternak.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anetamasternak.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce3e1d69-77b8-435b-985e-4753f4418956",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anging.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anging.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07b40400-1d4b-4060-9909-311740983dfb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anging.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anging.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f8cee25-3739-432c-be4c-766bc6885901",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: angolesist.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'angolesist.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--432ca7f7-772c-4a0a-9f68-751d42e85afc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhubgrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhubgrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f941a0f6-f3fd-4066-8de9-5189a9339378",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhubhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhubhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f6826b89-578e-4bc5-87ff-86c47a309127",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhubnest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhubnest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99e64863-6b3b-4d6d-8a6f-292c0f6a86bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhubonline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhubonline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--520896c6-36dc-49af-99a0-362ae30c0167",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhubset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhubset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c6637b6-958f-4d97-9e14-8f30a725416c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhubzone.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhubzone.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8530ce84-b3d4-466b-a1db-94df2c9756d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anhzxfw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anhzxfw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0f1dd78-a3ad-4a0f-874e-eb7cb2ef2699",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: animeheaven.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'animeheaven.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9bcdc8e1-67ab-424f-8fe7-f0413f7911dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aniwaves.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aniwaves.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d719c17-fa61-4310-90fa-259ed5ad7f82",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ansem.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ansem.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55c4adb0-5b34-4e2a-b5b6-7ec63f698178",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: answerbreakfas.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'answerbreakfas.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01e4d0a4-46be-42ef-bb05-391b2d122897",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: antiviruses.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'antiviruses.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a62d54c2-8cce-4f13-9902-de7e56b36f9c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: antoninazuchowicz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'antoninazuchowicz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70e1b91d-9c40-4cd3-ae4a-c316979699fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: antoniszpak.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'antoniszpak.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f690f84e-5d5a-4189-be06-f0712f391de4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anz-eigen-region.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anz-eigen-region.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eefc1d71-3d6c-4cf2-b829-c48cf2d5f155",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: anzhenpei.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'anzhenpei.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af9e629a-6bc6-4b37-8e66-643e148224e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aobama20265.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aobama20265.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e75e1d7-06ca-4f4e-bd80-0986e5bbf25d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aowczwaes8in0sm.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aowczwaes8in0sm.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81211e1c-42fd-4f05-bab8-0fbb31f9f776",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: apaajaboleh.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'apaajaboleh.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90a8b958-51b9-421b-8965-ac1944aaf737",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: apctwle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'apctwle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d283c26-0a51-4387-908b-396497db37e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: apiproxy.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'apiproxy.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2737aa04-2f4c-4036-bbbf-99cb3e9192b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: app-legal-ledger.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'app-legal-ledger.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33f0ae99-09d2-49a2-8e77-56faea29bb5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: appliedaisolve.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'appliedaisolve.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bf8d023-2eda-47e1-9ca3-a4127370ca90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aprocourse.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aprocourse.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d574f2e9-9f58-40bc-b667-d31162130a4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aptbuylegal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aptbuylegal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe59340c-0e00-48f3-80a1-035ff001a947",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aptlhm02.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aptlhm02.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2381402-3465-47f6-a977-cca280e6cade",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ar-1000zeus.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ar-1000zeus.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bb1c48d-f247-4107-9665-928f20e1e17e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ar-mega10zeus.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ar-mega10zeus.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dac1e5d0-18d4-4f63-af31-a32cbecb7c08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ar-mega1zeus.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ar-mega1zeus.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84ff232f-1098-4915-93ec-400c33bc47ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ar362.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ar362.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7299ac6-d284-4cbe-8c40-ef30b0197524",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ar5on.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ar5on.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c6b76a1-ffb8-421a-9290-2fcf431a3f7f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ar8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ar8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91935f38-cd39-48b9-9182-093d4bd3c9b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ararficosez.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ararficosez.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f46105f2-b0ba-49df-a83a-8b434f4d5416",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arbeviasen.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arbeviasen.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8df09e9-4307-4612-8801-18d3b90882e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: archhills9377.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'archhills9377.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29aa1a07-aeb3-4db7-9777-66555c531399",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arcprojec-vava.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arcprojec-vava.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18aa635d-a9f2-4ba3-a9af-ef795b95aac8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: areaclientes.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'areaclientes.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9b1045b-aa8d-477c-b504-367aeca5d342",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arena-portugal-ispaniya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arena-portugal-ispaniya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d18af313-073a-4a21-bd84-d76fb4254aca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aresbet-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aresbet-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--525dacfb-c8a7-4c64-bc4a-4b1fc0798b60",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arithdisco.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arithdisco.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79739432-d3ea-4260-9543-35b736990e2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arlenqemix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arlenqemix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e8aa25f-10d3-41fa-aad7-b2e7a6b51419",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: armaelektrik.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'armaelektrik.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6eae7a22-1349-4608-88ca-620f9be8b5aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arnug.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arnug.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c4e07de-65d1-4450-9a89-307c326310d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arosr.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arosr.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--acab8064-0e4e-432d-afbe-3c943bb10ea3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: arosr.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'arosr.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3c1f340-88da-4c33-ba6b-5c7fb6aac587",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aroundcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aroundcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e48b7ed9-dc8e-4f20-ac39-0913f963c03d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: artemisbetbonusday.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'artemisbetbonusday.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4ca6786-0ea5-4f91-a091-8da0998a4ac5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: artemiunyk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'artemiunyk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe761e0a-c0eb-48f6-ad16-653cec76ae28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asahikoi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asahikoi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7dfdfe44-a3ed-4545-b271-901f1ccb2fc0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ascendpivotrise.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ascendpivotrise.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f668d60-4e9d-4a4a-9259-ccffdc0380f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asdpasti.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asdpasti.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f65b78b-a78d-41ad-871d-0c1587d8fbda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asfasfdasfadfasdfa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asfasfdasfadfasdfa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4a19359-290c-4381-b5c5-d6249dd414ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ashon.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ashon.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23051ae4-598a-4c34-8122-f91f9d615894",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asia66.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asia66.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe296262-ba57-442f-8d30-dd0c6257da01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asisium-boutiq.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asisium-boutiq.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--861d80c2-99c3-48e0-ad3b-0aa2ffb4fa1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: askwc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'askwc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a39fcc5-8450-42c9-8a0e-30c3ff428a07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asmairlandi54.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asmairlandi54.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d129b4f-3f78-47aa-ae7d-5a852fc45102",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asnda.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asnda.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f487c490-9f98-407b-a6bd-9534dfa0f028",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: asperdefat.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'asperdefat.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--667b904f-cff8-40a3-880c-1f949245fa71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: aspiringvideoexperts.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'aspiringvideoexperts.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c00a46f-e53a-41df-81cc-581fad64ecc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: assemacino.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'assemacino.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79edb1aa-d5d1-404f-8b45-0e189f73df9c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: assesschoice.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'assesschoice.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cd4900d-1d26-4a8b-a760-ae4214240c8c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: assuranceaisystems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'assuranceaisystems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c602726-986c-4c03-8bec-c61beade0ac7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: assuredcompare.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'assuredcompare.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fadcc81-e3b4-4a29-ad62-8ff3ceca8cd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: astro-poland.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'astro-poland.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--200cbc40-cb09-47b1-92e7-2f748a1c2e0c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: astrology-poland.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'astrology-poland.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95884eba-4042-40a2-a7c3-5f9b8126c01a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: athorthomedgrushie.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'athorthomedgrushie.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--889171e6-65ed-4c05-b79d-b38ee1f17900",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atlas-bet-bahis.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atlas-bet-bahis.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47314988-604f-426b-8818-3c10e272e8c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atlas-bet-giris28.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atlas-bet-giris28.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30f1a65e-ed79-4391-be69-00acb34257ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atlasai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atlasai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78fff398-47f8-4dd3-b1cf-51ca53a4af35",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atlasbet-guncelkazanceglence.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atlasbet-guncelkazanceglence.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--36db2699-7642-4f85-b37c-efb0a70caceb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atlasbet-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atlasbet-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b80aa08-6de1-42ea-8476-8274ecf833bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atmbahis-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atmbahis-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9dc5efe-48b1-4b54-b284-c97b5cf4687c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atmospheknew.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atmospheknew.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e453ed70-857a-47ec-89fb-8a413d3fb1d4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: attentionbutton.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'attentionbutton.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7b98867-77a1-4518-8906-360e9669b666",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atwar.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atwar.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1826e93-f45c-4dee-be97-73c37ccfd3f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: atwar.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'atwar.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25b70721-fca0-4057-a1ae-833be3ec3612",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: au063.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'au063.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d824c95-a6b9-426d-8110-2f85528950d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: auafzyrjh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'auafzyrjh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9199ff86-9b33-439a-8ef2-5720e88c45b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: audithub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'audithub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b88f090d-c7bc-4b1f-ad9a-4c76b4b483a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: auroraify.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'auroraify.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a9a3dab7-dd9d-4678-99df-743cc26752cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: authenticatedocument-edriveshared-2fauth.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'authenticatedocument-edriveshared-2fauth.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef8b6991-c97a-45b6-8d3a-f0d5f678b864",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: authenticatedocument-edriveshared.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'authenticatedocument-edriveshared.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25884e24-1022-4363-a5aa-6b14ec289ae6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: authenticsoulguides.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'authenticsoulguides.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5575c96b-0e27-451c-8ee3-f8f971de74b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: authic.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'authic.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c56c5498-0d3e-4277-9ac7-21fd9850351f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: autobid-usa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'autobid-usa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f25b7311-d410-4c7e-83e5-61867b9ed609",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: autoescolasilva.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'autoescolasilva.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65490c42-d7e6-4727-8710-3165795308f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: avblw9p.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'avblw9p.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a90a73c4-b2bb-40cb-b322-43590e1ea192",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: avhai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'avhai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--958e51b1-08b3-4aa3-9c1a-3ff0eb4a51d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: avrupabet-official.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'avrupabet-official.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd470697-48b1-4fea-be5c-ba7cb4b7e8c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: avrupabet-resmi-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'avrupabet-resmi-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d553725-94c6-42ee-a308-55cfca9fa7b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: awcmzu75vvaw.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'awcmzu75vvaw.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c95e655e-b0b1-414f-a492-c8dbc11549ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ax5bet.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ax5bet.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77270240-4b01-4b75-bc1c-bb78e64a7205",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: axfctech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'axfctech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e0bcb2f-86c6-4f86-8998-239a51d29da1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ays.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ays.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18d6377f-354c-4278-9f2e-b74e69563a18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ayvecsp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ayvecsp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5aab3f34-6d52-4061-8655-75eb6cc8b6c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: az480.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'az480.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f72b2bcf-d150-4e06-a988-99683e9cc387",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b37cnem.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b37cnem.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--609fbb43-0e0e-440f-b9e6-b38fb97fe37a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b3b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b3b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43397f31-e500-4a30-8eaa-0b318dbbd23b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b3e.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b3e.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--558329fc-fac8-4adf-8e52-33e50cde6334",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b3qyppii87kpbj8.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b3qyppii87kpbj8.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7596e61e-de58-4916-aae7-bd899ae35a4f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b4r.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b4r.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45bc5a9a-77a1-4e28-add1-28a7d74404f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b56ssgpf8x.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b56ssgpf8x.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa5ff35d-8e52-4843-b687-8d7cfe79ad8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b5f5sgps3x.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b5f5sgps3x.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bd13c01-c145-4da9-b267-faf65a9e4665",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b69ssgp3ds.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b69ssgp3ds.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4124eea4-7f6c-4f24-a318-18f3277c2f6c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b75.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b75.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a863e06-2af3-4c04-91fd-323cbe883b9c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b80jm.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b80jm.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b615df64-03b5-43fb-a983-f2060e7f6e35",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b8brnk.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b8brnk.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76e0cdcf-4391-45ac-abec-e2631296a7ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b8l.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b8l.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--873784e6-013b-447a-bfe8-86e5629a13d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: b8r3z6p9w2t5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'b8r3z6p9w2t5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5d5d6e3-8a97-46b7-bb8f-fc8e8865e0e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ba3cc2774f269b62283096cd27eda191.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ba3cc2774f269b62283096cd27eda191.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a0fea3b-99c1-47df-a2e4-7a3a06033858",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: babahoki.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'babahoki.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9344dca3-7db7-4d35-9d31-b020c1f7ba1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: babfva.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'babfva.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0a2aed4-0a68-480a-8fc1-bc27eb522e99",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: babus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'babus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec86ec81-6acb-46e8-bef4-93a0ac556e0d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bac9sgp5ss.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bac9sgp5ss.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e934b3fa-52e8-449c-b24a-ab8ccf45dc72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: backmoneylaw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'backmoneylaw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9cdd3b69-9e2b-432a-8d0b-f12c7fbdfb73",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: backtothree.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'backtothree.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d18570b2-dc45-41ca-8df0-2c6c3ed15e22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: backyourmoney.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'backyourmoney.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eedab2b2-e280-4dde-97aa-2e9068ee2f1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baeca.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baeca.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f669cad-09ec-4ca4-8b91-74650616a5df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baeca.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baeca.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f32605c1-2686-4cf7-9e30-53d2ff090456",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baginda168iiqq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baginda168iiqq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e031e023-2415-424a-8c68-539a81535f7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baginda168qqii.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baginda168qqii.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e395615e-e29a-45fa-9231-e10abdf6e941",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bagoria.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bagoria.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed445193-6f61-430c-9b88-99dd90f204f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahibroliariosili.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahibroliariosili.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--534ef484-6f83-4a7f-b99e-663798d5d99b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahis2026tr.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahis2026tr.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3dce4171-83f9-4996-85bf-5fee675333b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahiscas1nogiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahiscas1nogiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c64cffd-30a1-4ec0-b7e6-8f9a11144772",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahiscasino-anlik86.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahiscasino-anlik86.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5cde55d2-0727-43db-9b33-4c3d2a71a91c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahiscasino-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahiscasino-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8aa9279-a979-495b-91c4-9b3231be382a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahisdunyam.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahisdunyam.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--026b7b92-bbd3-4b3c-849d-28e5d14987cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahislerim.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahislerim.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffb50800-02a6-4bcc-9284-d7290d3c2ba6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahislerim.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahislerim.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6d5e321-c720-489c-8056-21ca22803050",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahislerim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahislerim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a96ac080-8c7a-44a9-95ed-e2e484273221",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahislistem.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahislistem.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efe1ff20-dc96-471b-b3c7-78b6d5de4b7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahismerkezim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahismerkezim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b9d8acd-d9cf-485f-8d79-3b764b3a2362",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahisrehberim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahisrehberim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81da1fd2-a625-4adc-b7cc-4096053fd6ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahissitelerim.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahissitelerim.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c118fdc9-cf5b-4e2f-af0f-8bc48d34f325",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahissitelerim.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahissitelerim.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--202e4b1d-435a-4622-946f-bf10b02e3df9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahissitelerim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahissitelerim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb217360-603e-4e02-b478-a68e92ca12d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahisvipim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahisvipim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad757f13-5b40-4060-9117-7a5467c88b4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bahsegel-bahis.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bahsegel-bahis.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47030074-ecaf-4c53-9cfe-abe15bde2d1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: balancesheetrev.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'balancesheetrev.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49c30b97-321c-4893-b275-090118d68b01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baldeninfarehappier.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baldeninfarehappier.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--720c6da0-b6f6-4ef8-8b14-4d183559d3a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: balerina-casino.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'balerina-casino.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a75ef85e-60c7-43d8-b304-0ba393bd7085",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: balextra.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'balextra.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--657162d0-16b2-4785-8deb-47b01c636fc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ballingnanpie.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ballingnanpie.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--602fc065-d9dd-4d02-883d-9caae533aa38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: balon89.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'balon89.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--211b99ea-b716-4e79-927e-f84302e62a44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bamemkagatonovaebize.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bamemkagatonovaebize.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4212698-aea3-4738-a9da-0ad73dd7ef9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bamoksebigi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bamoksebigi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--deeb8c2c-e771-4900-a2ae-3dd8297ffa2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bandaque.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bandaque.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0f3cfc8-8d1c-455d-8678-8e5bb0a07a05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bandpilot.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bandpilot.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f22c1065-c2a9-47e2-87aa-180d2fd0ddcc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bandungtotoh0ki71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bandungtotoh0ki71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa9e9825-413d-4cc0-87c1-f3a13f159a67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bandungtotoh0ki72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bandungtotoh0ki72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b4b02d4-822f-4325-a6b2-51e9a81f21f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bank-up.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bank-up.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3283689-2520-4986-99c0-72d7af4f83df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bank77.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bank77.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3ebccbc-a7e5-404d-a8b8-0d99719d4467",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bankup.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bankup.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdbce22f-cdf6-43b0-97ac-300fff13e122",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bansoswin5vjd.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bansoswin5vjd.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13cb7d89-cd73-4cb8-bedf-d332936c0189",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bansoswin8qwn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bansoswin8qwn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c425d426-6c51-43df-987f-a490f8c83d48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baonongc.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baonongc.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ebd07e0-1ead-4d79-b7c7-3af2d3763582",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: baoyun.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'baoyun.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e33ee3df-ec8e-49f2-8b67-c3c362b3e232",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: barbaraiunyk.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'barbaraiunyk.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bba115a8-aef2-4fac-b168-35e004e73262",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: barbaratusznio.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'barbaratusznio.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09e65f9a-35e0-40c5-8047-50ec7c556127",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bargainbaby.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bargainbaby.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e964f6cb-3769-4bd0-9fe4-c55c637fc241",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bariyug.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bariyug.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--883a4c86-7d36-4263-961b-ae0852c1cce1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: barnheartmotor.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'barnheartmotor.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b30c27b6-85da-4d7f-81fb-5a22d4d2e58e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: basemeridian.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'basemeridian.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78f90cae-b270-4462-a81d-8664c1431080",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: basvurulariniz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'basvurulariniz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f6b75a7-6bf9-4bfc-a24f-7a8a594fe5b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: batmantoto00wds.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'batmantoto00wds.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e18801a1-b232-4e43-b195-604255c011ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: batteryresearch.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'batteryresearch.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f55bc495-5ffa-4419-8d89-c51073723e28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bauernverband.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bauernverband.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a048d214-9414-4833-99e6-0e9c9bd7fcae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bavds.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bavds.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--448623af-977c-4daa-8fea-90d8130e7faf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bazzigrand.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bazzigrand.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d9a5335-aa9c-4231-93a7-378a2949b485",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bb345.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bb345.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f151e7a4-3aba-4857-a146-4a4ea3d0c98e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bb4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bb4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8927746f-059e-47a0-aa2b-21134c5e0932",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bbbkk.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bbbkk.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60fd03f4-611c-4aaa-88d0-d86ce70e6e09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bcp-servir.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bcp-servir.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7523a25d-ff4b-401e-b341-d63a3916b0c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bcqqx.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bcqqx.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df3a44d2-1975-4a8a-9827-734a5c9ddddb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bcvqgld.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bcvqgld.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9e368ae4-d4c0-439f-8a08-ff8857b08a3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bcxxsvort.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bcxxsvort.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93008922-c771-4c66-95b5-348673444e70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bdbmarketing.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bdbmarketing.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33617d52-eb41-416c-bd61-7a8222b82ed1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bdzss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bdzss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--316ac8e9-8fb9-4f88-aca3-326fb0f985cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: be-directpay.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'be-directpay.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71ba34bd-f3e4-4650-a7b4-760672144962",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: be7au.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'be7au.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d99ca59-cebe-44bb-84d5-1883e0c6c24f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beaconvideonetwork.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beaconvideonetwork.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e6d03fe-c246-4f12-96ce-e057e9ff5819",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bearjl.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bearjl.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19705abd-d4b8-4ece-92f9-4280ccdca448",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bearjl.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bearjl.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2640a7b4-fa8f-499f-8cf0-0e59b7f6e6c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bearjl.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bearjl.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c962af7a-950a-4745-b485-3f538e3ccdd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beatabartkowiak.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beatabartkowiak.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6cc5324c-7d7b-485c-8242-6a06f774957e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beatakrajewski.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beatakrajewski.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5dae8a91-1b40-4e49-8dc8-80a16072440d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beatawasylikidziaszek.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beatawasylikidziaszek.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1cc341e9-849c-48c6-92c3-85b5681ceff4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bebadfevaze.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bebadfevaze.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f991fea6-0817-4028-949d-9920f0f6094f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: becomehimher.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'becomehimher.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d87d8664-023a-498d-8223-67be94d96ad5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beflix.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beflix.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c779afa5-301c-4bda-8b28-8ed48712892d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: begelxameciaugobe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'begelxameciaugobe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97731e6e-719b-458b-950f-aef73f4f16fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beirutescort.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beirutescort.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0b9bfae-3f4c-477d-a1f0-e7a38bf78786",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bejikelasade.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bejikelasade.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd837081-baa0-4841-9f40-32185c4756c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: belorvemor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'belorvemor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4002ad85-a3d9-4805-8fc7-b300c5cacd1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: belovqerai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'belovqerai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--388cecb0-305a-48fa-b4c1-d358565a55bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beltvan-vornix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beltvan-vornix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a527bffd-2c12-4991-9ed1-18e9be139964",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: belugabahis-offical.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'belugabahis-offical.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4635916c-3318-4ea5-8256-a0b888f30da7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: belupoulke.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'belupoulke.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8ba6b7d-153e-4694-95bd-1747a3f51247",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beneficiodigital-viaweb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beneficiodigital-viaweb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3b93615-b91a-43ca-950c-0430a917b7f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: benitaluterek.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'benitaluterek.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b5a44f6-7359-405b-bd6d-c9d97c30501f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bento4d2sdf.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bento4d2sdf.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7faf068-826e-4baa-8881-d2b72b3c1249",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: benuvar.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'benuvar.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e60cd90-15c3-4b9b-886a-aced96a6470d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beonbet-casino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beonbet-casino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d75b0be9-5127-4095-9a6e-1458b770ea13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beont.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beont.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4b2fd37-fcf0-46bb-8ed8-05366ddf77a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bepebpopoigale.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bepebpopoigale.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bf04bc6-5aa0-40b3-aa6c-e49b20f66127",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bephasei-m-repixelix-locloudi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bephasei-m-repixelix-locloudi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13599efd-02a3-43e9-8688-a53d42cc8fea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bernardjachimczyk.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bernardjachimczyk.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe47a4e6-2417-493d-89b0-cdce7f98e6c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: besodeplata.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'besodeplata.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1993409-f78f-45b6-81bd-0054115c3c24",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: best-super-game906.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'best-super-game906.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c1529f0-bc5c-4336-ab41-27fca998865e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestabboglet.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestabboglet.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--786e0047-ccc3-4bca-92e0-b878a04ba69e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestanlab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestanlab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed842a22-173a-4f84-a714-8befd8000b31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestbwnpehub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestbwnpehub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd10e730-5dd1-467e-9e23-f8f5cb0da1d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestbwnpeset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestbwnpeset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14e6cbd6-6f7f-4641-88bb-452e6d465dee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestbwnpesky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestbwnpesky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d1653ae-94d0-4b68-8089-eaee3514a6b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestdrolshub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestdrolshub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--886f2f36-4d83-46a8-a1a3-c2b4ad25e7aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestelcanhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestelcanhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbb46823-d5f0-44ad-99de-a7f40a235309",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestelcanlab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestelcanlab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--940b3cf6-a944-448a-9a77-26dd62bf42f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestelcanly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestelcanly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eaac9986-bc39-4c61-94d1-4a2cae7e1012",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestfootpod.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestfootpod.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2e1b467-c429-488c-bf07-5fdc3aab5101",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestminute.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestminute.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a08bcb46-2662-4b48-bd3d-d7342d79d8a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestnflowlab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestnflowlab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0380f2f-205f-4091-92e5-e6f16cd6f6db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestnsynchq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestnsynchq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07b505cc-d0c7-40cc-a6f9-b5a4cb43d66e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestrowthsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestrowthsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7e5c3ea-065f-4f16-a5b8-23f25bba2242",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a98de388-5cda-4039-aefc-476bc2042e38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestviralhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestviralhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--211b5d62-e9f3-47f2-b871-1301b29d94bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestviralkw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestviralkw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7212ecc1-ab6d-4022-85e9-f898bffcf21c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestviralset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestviralset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba4cca22-c7d7-4600-a2d6-971e6952fa22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bestwayusa-eu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bestwayusa-eu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7104ff38-7907-4f92-97de-321fc33ccb27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bet-cio-firsatlari.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bet-cio-firsatlari.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cafa10eb-55fb-48ea-b187-8424572f7ead",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bet-cio-originals.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bet-cio-originals.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6aa99968-de8c-426a-bede-c616e3d7731b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betasussgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betasussgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44f78031-c7c1-465b-bbd5-837d85ebf484",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betbey-com.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betbey-com.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dccfd901-cdc4-4afd-a1c2-6f917b2e2dda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betbigo-dogru89.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betbigo-dogru89.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b66363e-b496-4292-88e0-974502860c5d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betbigo-mobil95.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betbigo-mobil95.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1793ac29-7f15-4b0b-ae12-11e97ce4f668",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betbigo-yolu77.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betbigo-yolu77.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d7a1482-23ee-403b-b05b-8e904848cc7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betcio-2026temmuz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betcio-2026temmuz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c68d804b-de36-4226-b231-b7ec0ebba8e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betcio-7temmuz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betcio-7temmuz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--923e9ef9-dd9b-463c-9e63-efb7005b6dea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betcio-original.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betcio-original.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3de36e6b-58b8-4f25-95c9-34a1986f183b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betcio-yenilikleri.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betcio-yenilikleri.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28207002-7a1c-4d6e-925a-01e8c1531d51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betebet-offical.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betebet-offical.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae617a48-9ebf-484d-9899-ea1779e8701a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betgit-giris-resmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betgit-giris-resmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47cb81d5-4f06-4a36-9ad9-27dbb32f4c91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betgit-resmi-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betgit-resmi-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff49672e-419c-4e33-a84a-1a73966a2ecb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betgitlogin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betgitlogin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--374677db-14c1-4b45-b7fe-2f10c99eae48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betgitmobilbahisgiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betgitmobilbahisgiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff6ff36d-c200-4e68-b39b-33cab513a417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betgitmobile.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betgitmobile.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef0fa21c-7a1f-404a-b77e-c2b59495f8af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betgitonlinecasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betgitonlinecasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d0a61b0-de10-4667-b9c1-966b18c66a96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betine-offical.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betine-offical.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33dc282e-0569-4f1f-adb7-a88e443715a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betkolik-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betkolik-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fb987a1-8e59-46fd-9a0a-bbc3a9058267",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betkolik-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betkolik-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b56ee846-f076-46ab-a6d2-093a0ccc8349",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betkom-guncelgirisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betkom-guncelgirisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cb484ca0-f23b-405a-94c3-604d048981e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betkom-lisanslariniz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betkom-lisanslariniz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70408bf8-07a9-4c19-a607-aac8818b754e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betlikemobile.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betlikemobile.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a931da7e-5845-4e33-a184-db17c442bfb3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betmartintr-resmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betmartintr-resmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f6db03f-2b3c-494d-8c22-452fe2800b30",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betnis-kolay55.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betnis-kolay55.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2050be88-71b7-4625-ad88-1b25bfb3a920",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betogelxi71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betogelxi71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5a3a939-ed03-4a90-99e7-198fffffb2b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betogelxi72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betogelxi72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f048047b-2e7f-4f69-ae0c-59f426101d91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betonklikmxwn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betonklikmxwn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3370a3fc-b31a-4e78-99a4-27fed3361f01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betpas-7temmuzgiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betpas-7temmuzgiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--044a3b61-1975-4a86-806a-a7d0c4fd5387",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betpasgunce-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betpasgunce-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6e8ce2a-8a0d-4200-a3d1-dfdaaae61bf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betpasguncel-girisadres.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betpasguncel-girisadres.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15d6b0fc-faa1-4302-a21f-da4f108acf33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betpasguncell.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betpasguncell.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--013dd4cb-bd6a-482f-8d43-83f18aade08f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betpergirisadresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betpergirisadresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87e5b5fa-22c4-4596-8050-9f3f19b3b948",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betperorjgiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betperorjgiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0133157-b561-48e0-b26f-e53dc24fdc68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betplay-7temmuz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betplay-7temmuz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d43e4d8-7654-4c2a-9f03-de81254b2f36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betplay-baglanti52.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betplay-baglanti52.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d44f525-c5da-4c49-a2eb-1d1c2aa0350f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betplay-girislertam2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betplay-girislertam2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--677f8076-8be0-432c-ba4e-4dae9d7b1d81",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betplayguncellgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betplayguncellgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfad6265-fd23-4301-af7c-5f2f05787f03",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betplayresmitr.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betplayresmitr.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91fecead-f179-4521-83d7-c6477f9a4508",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betpuanvip.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betpuanvip.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99ed2206-d47c-4f88-a182-8243bc1b1cc3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bets1oguncelimiz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bets1oguncelimiz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b18f113-b7cb-4172-9a83-dffd522f7104",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bets1otr.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bets1otr.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4be8af4-1dcf-48c3-8022-7bf29526d197",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bets1oturkiye.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bets1oturkiye.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee59ecf6-61a3-488d-90d2-c3ea8834d69e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betsalvador-girislertam2026.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betsalvador-girislertam2026.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--386e2821-e87e-4de3-bfd1-a696ec51f807",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betsmovec.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betsmovec.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7995ff11-72d0-4853-b9c4-a15960156d05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betsmoves.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betsmoves.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa6c7fbf-4579-4d12-a2de-ea77fa89687d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betterhealthhub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betterhealthhub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b4892be-eb3f-4ea8-a9cb-d5b6a1130888",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bettickets.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bettickets.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d872a32-2280-4dc9-8c0d-7bd38e5079b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bettiltadresim.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bettiltadresim.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e83c912f-01f8-4f70-a1c9-9165df750b8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bettiltwinnerturk.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bettiltwinnerturk.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0b40fc1-2089-48ec-8611-933e096260b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betwoon-2026guncelsite.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betwoon-2026guncelsite.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f3c646e-427f-42d9-8226-4c9b26379185",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betwoon-2026resmisite.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betwoon-2026resmisite.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--474b5480-b3b6-4761-8718-d01ea4934ce2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betwoon-adresin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betwoon-adresin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d53ffff0-8052-441d-9823-eb6c66b85884",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betwoonkoruma.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betwoonkoruma.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dceaa129-23a1-4456-abf8-6afb6d77759d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betyap-casino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betyap-casino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c2d21ff-1e76-47b0-872d-87085a65234e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betyap-resmi-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betyap-resmi-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd0095b5-01cd-4539-ac2b-abfeb4bae4c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betzula-7temmuz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betzula-7temmuz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e2b5eab-4971-4ea0-aa71-c41e5cd30269",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: betzula-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'betzula-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab0fe99b-7bf1-43c8-853e-c3348422a475",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bevigxeviaebeni.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bevigxeviaebeni.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca4824ca-f8bb-4936-afd3-2bd516a9c36e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bewell88.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bewell88.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2aeb39c5-454d-4342-97d9-74c96c202c5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: beyondexectraining.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'beyondexectraining.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48ac0979-7f3f-4f17-bf57-14d5f9687df3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bezajduecupe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bezajduecupe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a076473f-a6ef-4785-8c79-ab95a653cb13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bf2qraaz865sxno.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bf2qraaz865sxno.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86280f0f-14db-4081-9753-25389c2c4bb8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bfedigital.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bfedigital.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a8b3550-13e7-4ffc-818b-bf453fe71555",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bfezljt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bfezljt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a030c99-4fe6-433d-a2a5-80de64ead8a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bg2gvp.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bg2gvp.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e3ea606-0d1c-4b8b-8c03-6f9d6fcc60e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bgrekiol.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bgrekiol.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42d33735-1adf-4f95-ba06-7da234401334",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bhjjhw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bhjjhw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c9fee5e-8b56-452b-aadc-6f115423e40b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bhoc3es.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bhoc3es.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c934e6ce-a15f-41be-9e3c-7d59cdbd6348",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bhxpzsiwems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bhxpzsiwems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--427b0303-2fb0-431e-9ba6-63cd2fa4e4ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bicaptiraivoafani.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bicaptiraivoafani.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1bac8923-a80f-403a-bbc6-57ef1e12f4c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: biceckaivoimaxi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'biceckaivoimaxi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--124fea75-8a4c-4270-a0f4-93fff9f0ea2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bicyclefilmexamplestring.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bicyclefilmexamplestring.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ade2b52d-d791-4993-b1a9-5ac467317356",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bidelcomfortpt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bidelcomfortpt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b9a8c26-e3bd-47a0-9a1d-fd730ee32941",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: big-bass-bonanza-app.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'big-bass-bonanza-app.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3a16e01-6f16-421b-ac47-eb02e453fbab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: big-bass-bonanza-app.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'big-bass-bonanza-app.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fdf69424-fefb-428e-8998-f7740b945192",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: big-bass-fi.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'big-bass-fi.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce9f4072-8462-4ae4-be8c-4ea2c68652df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: big22.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'big22.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75c8d926-8442-4a1f-a5c1-ae233a05638e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bimqaro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bimqaro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8f34303-34e4-49cf-8a8f-bd512e814c3f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: binamozajako.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'binamozajako.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ae128e9-93cc-4e7f-84a8-51586258f145",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bingo4d7zin.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bingo4d7zin.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98225cdb-989e-45c2-aa57-f97dbb3555ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: binibit.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'binibit.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6eae5d9-5e7d-4195-a417-2385dec1026e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bioes.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bioes.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e54cdbc3-37aa-4482-8ca2-d06930e82bd3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: biotide-lab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'biotide-lab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d87faab3-b5f7-48b1-81ea-40ef2759ce97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: biotide-lab.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'biotide-lab.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c486751-3d63-4407-b24d-0369a3111a4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: birasfadainedo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'birasfadainedo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4eb2e2ff-ffd9-4b1b-b128-47744a016c8f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bistarils.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bistarils.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1346ab73-6faa-46af-9489-5f1cd016dbc8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bitcrownltd.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bitcrownltd.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4331a486-9c7c-4104-a8a9-cf0534fa1b9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bitonfafapaexaheda.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bitonfafapaexaheda.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca6dd817-dd7e-4fb8-9923-d7d547203063",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bitraid.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bitraid.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3b04536-1b73-4e6b-87c2-03a3bad50425",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: biz7e2fb5jreeef.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'biz7e2fb5jreeef.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab41a090-2f8c-46e8-908e-c4518c36d3a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bizcoachprogram.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bizcoachprogram.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe34b018-86f7-463e-af3b-872cd2470678",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bizvaluations.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bizvaluations.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84e714d5-2b5c-4393-904e-31ba05a23c6f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bj7bj.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bj7bj.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35238267-2a5c-4e99-a563-00bf7989fc1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bjqzmyv.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bjqzmyv.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e354cc10-026e-4e60-b87c-07d9bed06e89",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bk3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bk3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a68dd8c-805c-4d2d-a566-79dcbee09196",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bkbuufng.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bkbuufng.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65a134f1-98cc-494a-9aa3-6f29052044ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bkeasyonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bkeasyonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--317c2241-96b1-4f7d-9ed0-508f14afd21c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bkofjacksonhole.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bkofjacksonhole.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7d43efd-2b36-43a2-a370-116fe1d8a55a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bkqylfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bkqylfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d54653d4-92bb-49a0-80f6-589dffb92576",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bkwzt6zfx1xg9h1e85pu.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bkwzt6zfx1xg9h1e85pu.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4bf2470-0ff7-4dd5-baa0-a7d69fae0033",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blackeycontemn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blackeycontemn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1bd8eac7-8273-4f23-b863-bc1f408916f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blackflag.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blackflag.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d73e2612-411b-46a5-83fc-dd6daa7f06c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blanq.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blanq.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a66905fa-3c6b-4a8a-9b49-387672af2216",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blazejwojcikowski.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blazejwojcikowski.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7129f535-770c-48df-805f-e25a3280ec22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bleand3d.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bleand3d.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f65f6dd2-5f90-46a7-893d-68634c1d729d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blh.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blh.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5a5e9e6-de4d-4f78-9104-bf33556cefae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bllss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bllss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56ecd0ef-6505-4b47-8806-e65ae9fbcedc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blobberdepthdieri.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blobberdepthdieri.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3dbf41e0-41a2-41e6-8d6d-58741b0f7ab5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blockexchange.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blockexchange.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62d32b4c-a4fe-4b0e-a3c2-05a5c82b2433",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bloqvia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bloqvia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b460353a-7d41-44b2-ae60-bf20c826dd18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bloucouiv.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bloucouiv.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--920f15f5-747a-4776-8bcc-e2bdd84f3d55",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bludeads.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bludeads.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34156274-7c89-489a-bdb9-a9a979fb368a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bluebirdzone-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bluebirdzone-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6083f8c8-893b-4efe-9ba6-2d6de2f631a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bluecloudnode-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bluecloudnode-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0dc4e0c3-ec9c-4f6e-b345-d4aa1a3aee71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bluepixelport-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bluepixelport-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6294fa6c-8f5f-4dda-bf92-78f5fcdb826c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blueprintforbooks.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blueprintforbooks.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a451f59-6fc7-4016-bf3c-ca3b65916f06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blueriverhub-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blueriverhub-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd9b5cd7-383a-4af2-a26d-01056132ae20",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bluesparkbox-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bluesparkbox-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be066b23-4a73-4b48-a5e1-cd1d33cf41de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: blvrdcollection.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'blvrdcollection.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c193e92a-8dbb-4e71-a829-591d6d2bebc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bo352.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bo352.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b49fa7e5-06dd-4ff0-9ba5-311d7d006f6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bobatoto00rtf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bobatoto00rtf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9bf98e5-05ec-484d-ab9f-758caa41ce32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bobel.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bobel.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--204677d4-fc46-4034-9b05-10d78e40f61c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bobel.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bobel.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d001ffe4-4efe-4ac8-8fb7-3abfb395160f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bobel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bobel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9ee02ee-1409-47c1-89a1-dec5dd0fffa0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bobudvoosalibo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bobudvoosalibo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f64c0c34-8480-4588-b3d6-e317b1467a09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bobunzacuse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bobunzacuse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df919d1f-6bf5-40b3-881d-61a5b36a08f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bocongan-gov-vn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bocongan-gov-vn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--538f39b5-4948-4bab-a6c8-ca8e1f478fa0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bodysubject.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bodysubject.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9838191f-b741-4002-bf76-16e137ff0364",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bodythingkiwi.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bodythingkiwi.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b48efac-3562-4c2e-8a1e-aadc4fe0dab1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bohemiumai-cz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bohemiumai-cz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5cc24a1-7f80-4740-9a66-d136d1fc8d33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bohemiumaicz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bohemiumaicz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ef5f89a-764e-4a1f-90d2-926150354748",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bokdeng.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bokdeng.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--178c86c1-3243-4186-b1fa-d3d6aace2b57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boleslawpionka.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boleslawpionka.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce9b8c3c-f62a-4247-85cb-9368abac237b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bombardiro-casino.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bombardiro-casino.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd462c38-5fee-47e5-abcb-577fd8bda225",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bomv-defender.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bomv-defender.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4edea954-352a-4a8e-8c44-b66e0d1d480b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonazihotita.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonazihotita.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--807c95a3-5655-4c7f-8419-624a01df2a1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boneghexieonakaki.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boneghexieonakaki.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86972621-8b37-4dc5-bda7-8f7ed2f165a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonusbetboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonusbetboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57d60cf1-e77c-4757-a023-f86ad9f838d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonusboost-winonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonusboost-winonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--608d0a8f-8d2e-46bb-a1a1-8c83a775d07c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonusboostbonuskz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonusboostbonuskz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80464b23-e847-4154-b548-1b8c138eaedd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonusboostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonusboostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bbb5b0d8-7329-47bc-ad91-a1084c9d4292",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonuskz-boostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonuskz-boostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a500e803-112e-4650-8c69-76a4dd40fe8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonuskzboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonuskzboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf089902-d71c-4485-b22e-a243b00bea4f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonuspoker88rtp.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonuspoker88rtp.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33b95242-439a-493a-9e41-254a46fdf45f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonusrtpvegasslots.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonusrtpvegasslots.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9ca1101-7543-4963-bfdf-4bfdd3a90b43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bonusun-adresi-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bonusun-adresi-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb7a10f9-faf2-4b72-9f5c-a166f7d984d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookaffinityhub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookaffinityhub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b616b8d7-e954-45cd-b23f-6575ca80335f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookallycore.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookallycore.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0acad5a0-939e-4598-807c-f7f75e07585f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookandsound.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookandsound.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be0018e0-ec47-42c0-b36f-3777c85dad47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookaspirantway.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookaspirantway.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80664a84-19bf-45e5-8288-837d4819a648",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookaxiscohort.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookaxiscohort.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbedc3f8-2080-4eef-9b8b-b834707486e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookbenevolentway.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookbenevolentway.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e926ed5-2ef6-4b89-9919-c7f92f6bb8b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookboundlessview.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookboundlessview.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c2025dd-419a-45fb-b609-5851b4d00cf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookchoreography.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookchoreography.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f6a865b6-7111-4b5a-aa12-1655caf0e425",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookdynamicsphere.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookdynamicsphere.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5cce2824-5c03-40ae-9cf3-f071f3a305fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookeditorinsight.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookeditorinsight.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb6fec04-ed5c-4947-b477-74f6fda008ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookfidelityworld.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookfidelityworld.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84d3c499-1f32-4158-8c68-3963b49971c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookguardiancore.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookguardiancore.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b4287ab-12e3-4fc1-b709-f0bedd1cb24c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookguardianstream.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookguardianstream.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b68a3fc-a0f9-43da-950f-d2813f8ab474",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookguidancecore.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookguidancecore.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7ef9b90-01f3-41c2-8c1f-9d5b02bbaa89",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookharborsphere.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookharborsphere.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43861812-f6c9-47e9-b8cd-c4487c033108",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookharmonypros.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookharmonypros.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1da4687-8bba-4f03-a59a-dd834f617620",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookinclusivity.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookinclusivity.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b4ef370-89ea-4a44-bf3a-7dc56ffcd5ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookinnovateguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookinnovateguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4afbf7ec-d6a8-44b6-a825-5f79e2faa905",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookinnovatekeys.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookinnovatekeys.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84ec26ca-f142-407f-80a4-8158690e9a4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookinnovatelink.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookinnovatelink.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3006c891-c565-49f6-9d1b-032d3e40d098",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookinsightstrong.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookinsightstrong.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--770874bf-317b-4614-a442-4055be266601",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookintellectview.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookintellectview.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca7071e4-6acc-4972-b8d7-714a4a9186c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookkeeppress.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookkeeppress.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee64cb58-7a7b-43d5-9a9f-2a4d9bf8e2a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookluxeadvisors.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookluxeadvisors.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ce794c5-6a71-4d91-b739-d74630cba6e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: booknavigatorspro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'booknavigatorspro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f04fe9c6-5b00-4c57-acc7-53f72ea61742",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookorchestrators.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookorchestrators.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33f281c0-5b94-4106-9cf6-d7a217199d7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookpalelite.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookpalelite.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4708804f-6e65-4b1b-a19f-c2e002ffc0d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookparadisepro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookparadisepro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cad80047-80db-4932-99cb-b05894d0790d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookperfectionexperts.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookperfectionexperts.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3692ecc2-c303-4c27-ba38-ff0ba057e314",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookpioneervision.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookpioneervision.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6338a6c0-4c30-4197-8250-e20b925a5894",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookpristinesource.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookpristinesource.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0755143c-ae52-490d-ac9b-044b4da30c05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookreflectiveway.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookreflectiveway.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef93c1ba-3625-4af5-97ef-2bd094b8a4b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: booksecurepros.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'booksecurepros.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3b3b952-b4f5-4f0f-8733-7314928fb55f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookspectrumguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookspectrumguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f709b5b7-2694-4d41-91f9-7bbd2452738c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookstead.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookstead.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cedefa31-c9ca-4b72-8644-96e5fdf9de84",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookvirtuosohub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookvirtuosohub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e5b05c7-6258-4881-870e-9da6c6e854a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bookvitalelement.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bookvitalelement.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18c1971d-a192-41fb-8236-c1f52ff8a3dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: booncointek.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'booncointek.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11862df5-2477-4208-ad90-7cfde9b9b3b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boostbase.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boostbase.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9749f62c-d184-4548-9db8-9664c7cf771e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boostset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boostset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd7246c6-5870-4e6e-9b06-640fd26ace8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boryslaszczewska.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boryslaszczewska.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdc412ba-a4a0-40c4-9115-ef0d63de848a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bosscourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bosscourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5567e566-0280-4dc6-b0f3-e465cdad4914",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boursetraderstock.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boursetraderstock.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf64d34e-99d3-4406-95cb-9378d1e22bfc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boutiquesolino.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boutiquesolino.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29d2d786-fa4a-48a6-b7d3-902728da2b90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: boxewim.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'boxewim.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3095a841-61a6-4100-98dc-b7217d90c945",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bpam-ai.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bpam-ai.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c575b736-a4f3-44b0-a0d8-188565c67e41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bpamai.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bpamai.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1284ef87-cf77-422f-b289-5617ad338415",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bpqcgfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bpqcgfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2496e4c1-b318-4b7c-bb2f-6f2e568110b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bpqgyno.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bpqgyno.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b74cfd6d-26ef-48b7-b73f-e3b319f2a136",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bpqvgfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bpqvgfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd12798f-2424-459a-8aae-66ec95ded417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bpxtyfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bpxtyfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd856ce9-4963-49bb-ac6f-2c0d52ab67df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bq419.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bq419.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc14f636-0d3a-42e6-af1a-b0284f5015ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bqbles7k2szizeg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bqbles7k2szizeg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd5ffacd-aecc-40ee-878e-ab5f47d77b14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bquhmj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bquhmj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa312e3b-30a4-4749-b21f-ed7cf866f53c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bqvgyno.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bqvgyno.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--154e9d5e-e429-4196-8dd5-a25070067f14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bqyzunfex850xnm.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bqyzunfex850xnm.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f127cf3f-aa74-4e15-8145-ea442023da27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: braeunigfarson.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'braeunigfarson.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2577a14-221b-4d51-82be-359ce9e1f8a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brail.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brail.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c98193d-9099-46bc-85e5-2d3462cec55a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brail.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brail.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32c7339a-bd29-4780-938e-2f5f6eed4bbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: branexo.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'branexo.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea29ee21-333d-49a7-a0d3-d31890701bb2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: braveraonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'braveraonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba84961b-d37c-45be-834e-0bba3510bef4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brcsdn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brcsdn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8414bbf-baa6-4e55-be65-aaf606bb81e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: breakfaspilot.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'breakfaspilot.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7924c55-a4c8-483a-9da4-e6b6c5dd8490",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: breakfasstudio.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'breakfasstudio.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--691dc6d4-6495-4903-be2d-5e4fab204100",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: breat.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'breat.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--086ed847-ad38-4175-9d7e-986abe54f68f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: breezyharbor.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'breezyharbor.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08846144-8998-4539-b969-fe3cb36762c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brightpointware.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brightpointware.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6cf66045-87b1-45e0-8524-d72af49592c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brights.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brights.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4bec66f-1b06-4bea-afb7-5ae49c0d4709",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brilliancevideoexperts.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brilliancevideoexperts.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d08e1a3-c688-442a-9974-6e3f783a53db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brnoharrls-us.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brnoharrls-us.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25b79ae9-1ec1-4147-a071-7c74111dc2f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brokerlegalhelp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brokerlegalhelp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4caf6162-9db1-4ec9-b4a5-b6f7fdf96b71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brownfacemusic.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brownfacemusic.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce62ee3d-f42b-4c54-bea5-42312a1ad818",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: browniecharas.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'browniecharas.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--361bacc4-923b-45de-bf95-9cc938e888cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brozalove.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brozalove.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7179cac0-8264-4a57-b28e-4592d19a8d1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brujulao.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brujulao.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a24d9e1-10fe-4a35-ba0d-eaa167c62a8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brunekavo.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brunekavo.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64aacfc8-a408-4c67-998c-f1e396efb62c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brxqyln.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brxqyln.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c45471b-9ce9-4309-88d7-8e10e366969b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brygidakoniecko.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brygidakoniecko.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c373fc6-7e2d-4b66-ac74-58717678d825",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: brytek.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'brytek.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0840d60f-5111-4b65-a488-55837c4ee55b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buccamestome.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buccamestome.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88659862-87ab-4331-95cf-170b41ad5d15",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bucusuv.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bucusuv.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3648cf5-92f9-41a1-8523-0dc7720493bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: budahfrequency.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'budahfrequency.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a33c904-2180-4d4b-8a27-74726c09e109",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: budipgaifabi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'budipgaifabi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc1e7e8e-f4d5-44b5-b321-14f4ca87c9f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bukidcemoaraabaco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bukidcemoaraabaco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58daff09-d491-4b23-becf-8dc556430745",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bukiny-lord.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bukiny-lord.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9aff4a1-2300-41e7-942f-339ad089ff42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f0f1e35-1c93-4289-8cdf-442bb9b1b5d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof1.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof1.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--02998d2e-1f9a-4a16-8372-e8af1365aca7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof10.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof10.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab1c1752-9b2f-4c28-ad63-1fa8eac4fa08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof11.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof11.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5adef714-590f-4b03-9187-80c455b59fb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca861aa4-1029-4c5d-bc48-3a253cdc8433",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0193a966-6ada-4411-a9e5-15239adbe62e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof4.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof4.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba4b21fd-f862-4ecf-bfa7-b5a562908ffb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fead3e06-b675-4f77-bd9b-9bceb469bd7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d867f3e4-d101-4122-8727-0402290f19f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof7.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof7.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--123e0aa8-c384-4716-925e-30885a1ca4fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8525be20-9caa-48f5-9db2-da485c73ce52",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buklof9.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buklof9.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1241b8f5-cf25-4978-aa8c-3254b6d8cac8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bullruto.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bullruto.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a6e5bbb-137e-44d9-8f57-1cf8ff646173",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bullysbeary.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bullysbeary.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4a84231-d23b-4217-8508-39c2ccaeab12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bultechgroup.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bultechgroup.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a4a6fab-d608-437d-8a76-9325b8b6ef11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bunapgilasopa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bunapgilasopa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1241e8dc-da64-42e3-a834-2530c6a0ef7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: burguedivino.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'burguedivino.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41cad199-9dbc-4571-9344-35c0800b6024",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: business-lt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'business-lt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2bd585d1-42b2-4cb9-9af4-74e7d9304b77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: businesscourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'businesscourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed689bc1-bd91-41fe-a68e-01b63d1955ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: businesstrace2026.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'businesstrace2026.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef9ecd69-d217-4631-bfca-5e89f5366209",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bussines.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bussines.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41865d72-429a-4a12-8fd0-4e0e828a1444",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buwifip.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buwifip.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--938138d9-e629-47ea-905c-009d68050047",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buxacrozapoloeboza.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buxacrozapoloeboza.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b8e26b7-ccca-44bc-9090-b5583f9cc194",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buxaktopenekava.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buxaktopenekava.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a9ac241-3cf2-454b-af9c-3c05fd30bc46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyanhubflow.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyanhubflow.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5054083-dd5b-4a06-96fe-7aaad4f91ef9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyanhubnest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyanhubnest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0fa8822f-3916-4f3b-a8e2-c1ac83d8023d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyboostlink.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyboostlink.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5505b3ce-8c97-49a3-b6f1-35af29207420",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyboosttech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyboosttech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e52b110-9e23-4889-9ad9-f2006dab8973",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyboostweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyboostweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dad8964a-e408-4f03-90ea-b23930372368",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buydrolstech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buydrolstech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7be562a-6edb-4c71-867a-a5c04c146924",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyelcanhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyelcanhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a373da57-8d22-434c-a0d4-bd4ac98d0633",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyewhubset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyewhubset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1acd326-f856-49f5-834a-e63e30518bc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buykwnpl.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buykwnpl.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c84c4676-9dbf-4e54-8521-f3dead4b0d94",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buykwnplai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buykwnplai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4557b30-ee54-4782-86d5-56fe429d2414",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buynflowline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buynflowline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8dd801d7-510a-48c7-bff6-621b36bdd28b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buynflowway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buynflowway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dadf2bd4-6c6f-4dc8-9861-d1468a7147e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buynsynchub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buynsynchub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4531bb56-e3c3-468b-a033-78b92ded9799",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buynsyncify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buynsyncify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32969ee9-178e-4f70-95a7-d62fd29fd8a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buynsyncsite.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buynsyncsite.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a61cc97-d5ec-4243-a146-59237b53b84f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buynsynctech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buynsynctech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ead27697-efb2-47a4-b29e-beb314d98870",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyolvansky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyolvansky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f91479cf-de98-4db6-9b32-49bda5646894",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyrowthai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyrowthai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8128d53-aef5-4800-ad41-674a1a69b627",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyscale.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyscale.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6058ea2-cbd8-45be-b3b8-ac6be2ce3243",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyscaleline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyscaleline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7669bf3e-d1e3-4ad4-a75c-f69f71d15971",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buysmartline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buysmartline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6dd391a7-5319-4a96-94fb-4942a34423ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buysmartplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buysmartplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5d446e1-2e0f-45e7-83c9-a74d8680cc4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyviralbw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyviralbw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea3466b7-7179-443d-8950-b19a034a9aac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buyviralgrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buyviralgrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d124293d-9997-4916-903e-c5013e8b95da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buywflowplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buywflowplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c55a8d0c-af5d-40d2-a0cd-176ea7371b4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: buzijak.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'buzijak.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c6fa625-9c63-4a07-adcc-ccc9816c1ed2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bvlphke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bvlphke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed3cda59-9e4d-4727-8f0c-cc2d8cb968e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bwajeffwashere.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bwajeffwashere.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6e3de16-4530-4625-8e50-bb1745d89133",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bwnpegrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bwnpegrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb28fa71-ba3c-4d77-bb1d-d99b1ec7ad7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bwnpeline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bwnpeline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4395985-8037-4d36-b8ee-5665047b1f3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bwnpeweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bwnpeweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef384e8e-d605-4545-8ff0-ee26bc6dfaa5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bwptkhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bwptkhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0f93d15-1bd9-4606-8e2f-325ce8f372a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bwyeu.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bwyeu.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5da9305-1032-448e-85a0-43db4e9ee489",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bx449vc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bx449vc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b32aa3c3-1e50-4caa-a8c2-5c435d48516d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bxf5sgp3ex.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bxf5sgp3ex.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5b4f935-318a-4524-9080-534aabc577f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: by0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'by0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4ce7a86-d0e6-4a6a-83f3-dac497468a70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bygcloud.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bygcloud.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ba81de8-d441-4337-83a6-98a820b1120f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bytecube.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bytecube.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7bba290-c2bd-48cb-ad4c-8a33a437ba9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bz3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bz3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01517691-d57a-4b75-b744-7b4f369001c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bzb0881218p0b2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bzb0881218p0b2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c85aebf-7025-4984-9315-3437ae4b8538",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bzb0881218p0e5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bzb0881218p0e5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--265e06aa-fe55-4a91-8dd4-3a53c61e2aa1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bzb0881218p0h8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bzb0881218p0h8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39393c9d-1791-4ed7-a7c1-3b76524a5ccc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bzb0881218p0k11.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bzb0881218p0k11.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27a6aede-a8bc-46aa-bbf5-8fd32de7b240",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: bzb0881218p0n14.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'bzb0881218p0n14.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0f401ec-8ffa-4ef4-86db-db1af9d21e92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c0o.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c0o.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6bca6bae-a0ba-4c2c-a821-67066f035664",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c11.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c11.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21845420-c09a-4c36-80bb-104371260951",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c1dtl.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c1dtl.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--679b823e-5421-4a8d-ab56-6dddf0762048",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c24fsgp89e.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c24fsgp89e.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e45a969d-a26a-4359-9b29-17dda6b75b05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c26r3l.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c26r3l.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4544a973-1ce9-4b52-9f4b-18e45e2fba51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c3kufz1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c3kufz1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33157c1b-e87e-401e-bf19-2501486a9307",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c3m.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c3m.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5da55b2a-a190-4b10-9627-db6c82aa6b46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c4z.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c4z.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90104566-d7f0-4000-a031-02f7a43272d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c6b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c6b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--829a09ea-9759-4719-b1aa-c455b225df6b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c83esgp6cx.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c83esgp6cx.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e550b968-2d05-460d-a83b-258b91362901",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: c9f.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'c9f.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c655c108-74d4-497b-9d90-93ed265bc017",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: caashwiin.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'caashwiin.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13ee3255-26a9-4298-94d9-394119cb40e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cachetcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cachetcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b45bb1b-aa01-4815-8ec9-35c910628aac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cacixxamaloakela.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cacixxamaloakela.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cfff582b-d3bd-42d3-a443-210f20447258",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: caddellinsightgroup.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'caddellinsightgroup.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6239f7f-e65c-46c7-8956-2c05a41946a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cafe-folgers.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cafe-folgers.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76a13b6f-2168-48d4-be2f-95899e6748a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cahayasoa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cahayasoa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--888804b4-a7af-453c-a81a-c7aa9b8f36e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cahayatoto7edc.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cahayatoto7edc.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67b27f46-ef19-4553-8585-7543fffc48ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cairbray.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cairbray.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40bfcd2c-cb9f-432b-87fb-173fb2c27f7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cairhoki.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cairhoki.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a013d9c8-50c2-41ae-b924-27e3f69a27af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cal9x.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cal9x.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--599cd570-bd04-4825-8752-c3c22ff5db77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: calmoravella.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'calmoravella.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79e9ed8d-c31c-4ab8-a46a-1b11b0df9552",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: calmstead.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'calmstead.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1a9714f-3f45-46e7-9d5e-34e1c40b1d42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: camibximapucogo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'camibximapucogo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86a24c43-f3cf-46d1-bff7-f17633bdde8c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canasib.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canasib.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f453bf2-5fb4-49ec-a508-359b39a06d26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: candidatedatabase.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'candidatedatabase.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45bf99fe-9a32-48be-86b0-80e59f9e5ccd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canfa.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canfa.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8818bd2-4d11-4b80-a905-f7ced7659b63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cangcutenasieolwmco.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cangcutenasieolwmco.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86d4b990-5046-43cc-b547-45690ab09d5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canjearloa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canjearloa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ad74c72-1781-4eab-996c-9ca56a244eb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canjearlos.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canjearlos.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c790c8e-925e-41a7-9e03-a6744cb9c529",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlibahisler.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlibahisler.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a16604eb-0296-486e-a24f-f6c21eb6b24a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlibahislerim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlibahislerim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--125a5dd8-7eda-4fc0-99aa-9f1f42c8cc1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlicasinolar.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlicasinolar.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4f9985b-45cc-4d2d-9f26-ba0f4dc00070",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlicasinolarim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlicasinolarim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed68172b-658a-4584-a3a7-547b12e4678b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlitango13.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlitango13.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--190ed859-1735-449b-8a94-421433451e8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlitango14.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlitango14.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f916bf64-0730-4880-a685-d59bf4fea0b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlitango15.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlitango15.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dac5adfb-b37e-469a-801f-604ae75fec53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canlitango16.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canlitango16.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f18223a-3a95-4959-b6b2-d5f4d4755ba7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: canvaa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'canvaa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--36546094-a30a-4b91-81e7-6099ecb53b43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capex.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capex.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb132775-a8b5-4419-993f-250e24f52c38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capital-dreams.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capital-dreams.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f572be2f-c326-4273-81d7-fb8208882ddc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capital-top-falqeron.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capital-top-falqeron.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de41af68-32d0-40d6-8118-aa1859692257",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capital-top-gavxeron.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capital-top-gavxeron.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e315779-695d-4fac-be94-c22ae90c1368",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capital-top-horqavel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capital-top-horqavel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0236fb7-343a-46e2-ac3d-24b7c3455ad2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capital-top-horvexan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capital-top-horvexan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b65b3580-5bd3-4172-946b-f354d9e1b1e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capital-top-jenvalor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capital-top-jenvalor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47190189-255e-45b4-b07e-bd032add79cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capitaltop-horqavel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capitaltop-horqavel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae6c78a3-8e3e-4332-b63f-215f6e4bd7ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capitaltop-horvexan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capitaltop-horvexan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c9ad011-c040-4885-9df8-f79cac968f64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capitaltop-jalvexor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capitaltop-jalvexor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d39ad964-86c2-4325-a117-471019a68a97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capitaltop-jenvalor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capitaltop-jenvalor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f389b21c-fcc4-497b-95cb-8f350339f0e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: capitaltop-kenvorax.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'capitaltop-kenvorax.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22c1dea8-cae5-4a93-8b3a-f9fe3f138a25",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: caraksotoexepixa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'caraksotoexepixa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1f0c768-2a37-4259-a839-13c928c80239",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: careercounseling.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'careercounseling.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b7e4035-2ab0-452d-a99a-e48cc064d29d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: careerglowpro-dgi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'careerglowpro-dgi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b052728e-4dac-4887-a405-4da4a0b7d3d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: carelegalhelp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'carelegalhelp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--811a6aba-9950-4c65-85c8-c8d32f098535",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: carousell-hkreceive.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'carousell-hkreceive.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ece9c9c-fc8d-44cb-8fef-93e068164a33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: carousell-hkreceivepayment.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'carousell-hkreceivepayment.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e028d49-212f-4443-b8dc-1576709ce9da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: carregamentoficial.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'carregamentoficial.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6477313e-3035-407d-a079-0a3c895466c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: carregamentosegurofc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'carregamentosegurofc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ea7df5f-0590-4080-a107-6612f2342e10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: carregandoagora.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'carregandoagora.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff3937ec-7043-4101-9bc8-359dbea733e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cashbackdominobetrtp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cashbackdominobetrtp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a41df92-fe88-4fb5-9a82-c0274def4e68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cashforecastpro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cashforecastpro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d00d5f9a-fdec-4966-a771-b494c64945e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-adresi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-adresi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbf1c35a-7f8c-4543-b839-2115cfe109d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-casino.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-casino.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd6b4829-d5eb-4335-94ee-247ac1a4bb80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-girisic.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-girisic.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00db1a1f-9129-4465-a528-0b4af6d21b19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-girisofficial.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-girisofficial.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bbebc3e-3127-436d-ad29-6fd7d5a1e4a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-giriss.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-giriss.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19e9ae45-a8e3-4c45-8a7a-1aa294f4a5dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-girisyap.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-girisyap.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51d8d269-68df-4472-bb59-a64fed70b2af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-girs448.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-girs448.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2334fdfa-592a-46ba-8a69-09ad60cb19ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-guncelsite.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-guncelsite.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--353758cc-8166-4987-9f25-07bef2341cd7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-temmuz.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-temmuz.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b5043d9-471f-4543-8a62-830f240b144a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-vip.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-vip.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f04b94df-b0fd-4e15-8b0d-c7855f2fa784",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-yenigirisadresi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-yenigirisadresi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73386ca0-d58e-487a-9aa1-1969c1622e86",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibom-yeniresmigiris.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibom-yeniresmigiris.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9701fcee-9bb5-4730-a6c8-620597b557b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casiboma.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casiboma.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--309fcc8a-3f0a-43a6-bd50-4bf30d76a764",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibombet.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibombet.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66ef15c2-5952-4db7-8570-3f9ebf74786a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomcasinogirisin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomcasinogirisin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9ab5e39-b7e6-4129-bc85-1e8984de0bef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomgir.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomgir.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d0d47a8-4387-4580-bc38-63bf7bc4a1f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomgirss.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomgirss.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e65bc36f-33d5-4114-b711-13e13b1a5177",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomgunc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomgunc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a95e777b-ee94-4e15-814c-e4b4d3833441",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomguncelgiristr.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomguncelgiristr.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--674abd39-5bc9-4f3d-9943-6e068f518e59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomguncellink.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomguncellink.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fbbcb2c2-8625-448b-8141-4b5ec306cc71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casiboml.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casiboml.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a8260e9-e844-425c-b0f9-06c78afdb9ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomsite.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomsite.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8c7851a-f7d0-462b-b26b-d87fe283afe5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomsonguncel.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomsonguncel.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b11d313-57ff-421b-8141-ac88824c25c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomsxgirs.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomsxgirs.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a099e1f7-f460-451d-9431-907c269b7e1c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casibomvipresmi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casibomvipresmi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0b4fe60-5220-4799-b45d-9178c249faca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casiinometropol.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casiinometropol.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc6d1a5a-7175-4919-af7b-887913dc9dce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino-0607.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino-0607.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--069d376d-ee1b-4b24-9795-ab6b9c15da49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino-0607.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino-0607.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3d70981-5559-4eee-8de3-1f9912cc1aa5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino-jetbahis.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino-jetbahis.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68104347-cf8a-48a7-949c-edb43b33ab13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino-jetbet.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino-jetbet.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--572f308b-594a-4c07-a1d1-eafa1fae90ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino-marsbahis.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino-marsbahis.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--073ef4bb-90a6-4970-b802-24f035e0eec5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino-meritbet.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino-meritbet.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14515fe1-befa-435f-aaa6-15b00a55d88b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0291.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0291.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de715273-282e-4e72-8a11-3a54b75ab126",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0464.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0464.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62d07e41-f0b5-4d67-aa03-651b03b3787e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0531.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0531.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dde4054e-b303-481b-aef8-08b1c9507f13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0688.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0688.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bc9f3a5-5411-4211-8967-bbbcb90524b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0707.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0707.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe9e68aa-55bd-4ffe-815f-0b5d8d9b09e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino08-07.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino08-07.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e230ea39-5338-49e1-b744-a50f63d01a47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino08-07g.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino08-07g.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ede2bf29-50e7-40ea-885c-f85f66eba2a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0807h.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0807h.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76d52ca3-0ad6-444a-9248-89a6d50dd1d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0815.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0815.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00a06d50-940d-4bd4-a853-468beff9a80a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0907.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0907.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce922ee1-2ec7-497b-b007-2326c2dee57d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino0914.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino0914.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f37360a-aa83-45a3-91b7-eab73f3064d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino10-07.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino10-07.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--acb3caac-fc55-4ee6-8bd1-3c559a03ae31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino1000p.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino1000p.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3de10687-5a0f-42a1-8b32-cf5244a50421",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino108uj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino108uj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73430c1f-8ffa-4dab-ada9-3bda66107f6f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino1309.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino1309.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--137b674f-8298-424b-bee0-c54e4c175b6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino1860.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino1860.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2377b694-669d-486e-b154-3f13413ec911",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino1wvt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino1wvt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c53befa-838a-4941-85d3-c91afbf5e082",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino2103.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino2103.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f5c19cb-e3a7-4b67-a1ef-2f2ee601716d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino2105.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino2105.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65df2fc7-4d3e-41d2-8ae1-d5ccf91c757c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino2189.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino2189.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--518d686a-ea13-4f4c-8da9-83df0f259352",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino23j.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino23j.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89ec013a-e0bc-452a-abc1-f8ecf7844a09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino26-0807.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino26-0807.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44193062-c9d7-4f50-965d-0fe68b61458f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino2817.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino2817.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--917cc904-6565-4911-a7e0-6c44fba02b99",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino3126.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino3126.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c55cbfe5-6cb2-4deb-a06e-37b2fc9905cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino3251.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino3251.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fcc42897-f6a0-40b4-b033-9ad963349d89",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino34d3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino34d3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba721678-e67a-4af8-8588-63d5bae25a25",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino4031.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino4031.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9679424-b866-4b43-bbd7-a7b3e8e1c6f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino4100uv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino4100uv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43b900b7-ea42-493e-8b8f-98ac5e7d233c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino4598.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino4598.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--155f5b01-c1e5-404e-9775-892632d4d01d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino459sk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino459sk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9eea3092-f226-413e-b541-30369152f979",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino4828.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino4828.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fffdf930-b40e-4e3d-a777-1ead6d09966e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino4nbj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino4nbj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0aa4cb1e-1dae-4b7b-ad98-47a2aacba443",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5000r.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5000r.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52f621ee-397b-442e-916c-7cd3570f11c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5123.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5123.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6e582f1-347c-48b3-b178-ca9d5e68006f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino53sr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino53sr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc116548-9c20-499d-9f16-0922396ff533",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5452.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5452.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9cdbd92-66cc-471f-b6f8-676a4be44322",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5584.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5584.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a889574d-bf7f-4d7b-b703-421b6f21955b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino561.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino561.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56cb78cb-4fee-4910-b9b7-a104fcdbc9fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5623.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5623.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebb690f8-7016-4cc8-9bb3-fa2aee7986d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5778.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5778.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f36cf90-e7bc-4127-b109-d8cdb205ff54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino5x85.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino5x85.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13d90d39-d6b4-4d1c-a4c6-1eccdcc424ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino623fgd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino623fgd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--183db305-7c75-451f-96ce-bd66cbbc390c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino6254ko.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino6254ko.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aecd0310-21b6-4624-b5bf-a233050295b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino6584.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino6584.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0cd508fc-2f08-4544-ac4e-b115efee6db1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino66e3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino66e3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc5a768a-7921-408c-8321-bca4d4b52fb9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino6936.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino6936.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f9ba697-a2b1-422d-ab3d-ec0a48a46bb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino7060.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino7060.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d6a36c7-febd-4f55-84cc-d195b65af1a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino7639.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino7639.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dcac94e4-1869-4d93-9146-208eec93ad4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino7740.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino7740.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2187897-cfbd-42fc-b511-3cc7fc03e28f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino7817.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino7817.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--acf8a161-f9d7-425f-b3d6-02145b970c16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino7978.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino7978.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52a2be4f-35cf-4b3e-b9c8-ad3436ff5b80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino8003.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino8003.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8b95dd1-fe68-4f1d-866a-9f21af45170e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino8070.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino8070.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70276c47-af42-4dea-a43c-6e3dd04de202",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino80nf.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino80nf.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a23538bb-ee75-49de-939e-fc45fb09bb02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino8118.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino8118.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78a81184-930e-426e-8f91-279b510adc17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino866.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino866.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9de434d-57a1-40a0-9411-a486b550757b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino8915.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino8915.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb82fec3-2697-458e-98f9-92e9fbacee58",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino9138ndw.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino9138ndw.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--426b706f-5cee-4684-97e5-bddace6d94d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino93s2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino93s2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68375921-ef84-4047-99f6-fbbeb93d46e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casino9967.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casino9967.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a816b09-4d70-4585-8928-1fc3d0cfed29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinob71n.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinob71n.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be32e990-b4d9-489b-aebb-9ccb93acf6e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinobkwf.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinobkwf.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--204a6c36-00b0-4792-9da5-1413f742ee68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinobwg6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinobwg6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8be3d6ec-0863-447b-874d-ad6ba5ecdda0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinochushok.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinochushok.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d119c629-ecc5-46d0-828c-384d69f96144",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoci44.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoci44.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2dc53655-bb2f-473e-850d-5d59cb0fe3b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinodcin.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinodcin.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16759205-ccb0-4c97-aa77-b33b1f632adf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinodo7k.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinodo7k.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9a3d4b2-e6f5-4367-aa54-363349d8b8fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinodunyam.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinodunyam.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73c8afb4-d440-4ddb-bc87-2e708dc25aa6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoespada.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoespada.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ee4f975-581e-4b8c-a735-1538f1facb17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinofast-tekgiris2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinofast-tekgiris2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b0ad692-efda-459e-b4f9-cafdab1f7c2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinogngk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinogngk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffeec006-9cdc-4283-ae9b-28366ff281ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoi63g.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoi63g.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdf40a4b-01fa-453c-a66b-4a74142f48b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinok3ht.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinok3ht.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--463d52c8-a428-43d4-8f1b-70abaa9cb47c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinokotik.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinokotik.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--374cab0e-0166-403b-8530-2e61056af630",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinolarim.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinolarim.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd59588c-c362-4d5b-9784-3ec851d95969",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinolarim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinolarim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6c3f45f-9e16-4c47-9fce-20f251fe2bdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinolistem.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinolistem.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68fbcf75-62d7-4ee5-8479-b7545fcd5c3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoluzon.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoluzon.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--caffe20c-9b38-4dd0-9b67-36521f2cf73f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinomaxii.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinomaxii.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3140bc89-e544-4681-9dda-f5e00945f0b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinomayhem.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinomayhem.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39bcaacd-d1fc-4bee-aa69-d22dbfbe075e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinomerkezim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinomerkezim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ee791c9-2b3a-4867-a4a2-dd895880a9f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinon0cl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinon0cl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--355131e9-4724-428a-a632-5d0b70f2fba8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinonsj7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinonsj7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f710433-3b49-4280-b56e-285dd2845b16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoplfn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoplfn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44b1dfb7-ccdc-4ee5-8cd2-04139994b9f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinopmqe.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinopmqe.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a503d8bb-efd7-4975-9b5b-f124a4bac04e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoqz7s.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoqz7s.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac9e0689-f643-4b6f-9380-a80a187386a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinor9z6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinor9z6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3b93795-0ba3-43fb-aa74-3c6dd15cfaa0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinorehberim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinorehberim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b84178c2-dc9d-493f-89ab-a68850be4e78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoroyal-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoroyal-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--340d4a4a-7ca0-497b-863a-77b03fe635a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoroyal-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoroyal-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60a9b9e7-cb7f-47e9-b132-3dfa0c514e62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoroyaladresin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoroyaladresin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--008d8dac-a8b0-4e44-a9fa-3c36e26bc411",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinorx4t.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinorx4t.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--736c13ce-ef78-4620-b529-2360b72db83c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinosharkroll.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinosharkroll.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e16435b-7d9a-42b6-a495-8f658c548753",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoshlang.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoshlang.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d684f6b-a07e-49bc-9770-0f371f5a9927",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinositelerim.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinositelerim.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68893e59-f43b-4d5c-a88f-ef6e65c7064e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinositelerim.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinositelerim.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df777e17-4d3f-41d2-b336-ad85b1f9d522",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinositelerim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinositelerim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e212bfa-fa80-4cd9-9844-407e86d81a24",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinosn14.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinosn14.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3628eeb8-8554-410c-85fd-731645cf58c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinostiletto.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinostiletto.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--287c5af3-ad88-4500-85fd-758f5197d7c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoutanbankidse.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoutanbankidse.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--398105ef-f4aa-450a-9d02-496050a76b5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinoutanbankidse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinoutanbankidse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59e53969-7c66-415d-84d4-4a2d9b93ec80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinov4sq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinov4sq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56059766-3a89-4d24-a29f-21a00d30fb5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinovipim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinovipim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ac3d3f3-143a-4ade-b551-d689b520b767",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casinozhz7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casinozhz7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4a9db1c-545f-485b-811b-fcecd049e169",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: casiveragir.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'casiveragir.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5cc3680-5bf8-42db-ade4-070baffb4308",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: catalpapeak.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'catalpapeak.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b8f87c1-3678-40ed-9ca0-66cf60d09aa5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: caucesur.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'caucesur.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e016f0c-3336-40c3-ac34-8bdecaf50d0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cavilmizido.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cavilmizido.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35adbc21-8df3-4eb7-979b-81956fb094d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cavnori.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cavnori.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--840de2b7-ecfb-4866-9119-b470e3cc61d4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cavuga.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cavuga.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a878172e-c744-4699-9938-3a9822a8fe07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cayugascorded.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cayugascorded.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9db3f8f7-44f6-42c3-8f3a-c94ae12ed383",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cb9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cb9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92b8f713-39cc-4055-a412-5a0d361a8ca0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cccdn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cccdn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d51d0714-d798-431e-b11e-0b55bd7be48f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cchhgp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cchhgp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fda1ea5c-29e0-4a29-ab64-aed91b3210d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cctools.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cctools.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce57cd29-a5f9-4d3a-974a-43b84c6cd7b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ce6bsgpf8a.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ce6bsgpf8a.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c72ae43c-d3cf-4009-b59d-2e2f1dbb2470",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cecoffobedeexigovi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cecoffobedeexigovi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2bb551e2-e664-425a-b29e-235391fd2bf5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cedarline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cedarline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcfeddfb-253b-4500-a1e5-d6dafbc2330e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cedetleviitoka.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cedetleviitoka.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a897279-b14c-4eea-b10b-4c6db6934e54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ceficvaacibu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ceficvaacibu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0923e88-bde2-4c21-8e3f-24d794cc70be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cehdexwsd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cehdexwsd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1faab9c5-ceb2-4b44-8eac-dd34b9e856cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cekal.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cekal.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f50b973-76ac-496b-8f5b-e4aa05217819",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cekal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cekal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b616fed7-a899-45e3-8dd5-6337bd307960",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: celilgeeoemige.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'celilgeeoemige.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7fc2a7bb-f8e1-4aa2-a531-8bff61b56992",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: celtabet-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'celtabet-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6277174e-79a3-43cb-b249-13abd0fd4701",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: celtabetc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'celtabetc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bff6b72d-22bf-4bb7-971f-ba2958802587",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cendral.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cendral.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9941b97-b273-4d68-86cc-6faed6c2cfbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ceneo-homepoland.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ceneo-homepoland.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f23e3c7-63ae-4987-962e-220a56e861cb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ceneo-qualitypoland.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ceneo-qualitypoland.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e3cf8e6-3ce4-4a0e-9271-11f1ee0c5720",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: centeredsoulcoach.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'centeredsoulcoach.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7bb30f3c-8105-4b14-99a5-ae59a3bec54f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: centovaperugialitt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'centovaperugialitt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a35d88bd-36cb-4391-815c-35922c26cbad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cerrakros.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cerrakros.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ae702e8-efba-4258-92a8-1e68650bdbe8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: certdochub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'certdochub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--244a1120-52bf-4ddf-b04f-817b75573544",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: certifiedirpartitional.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'certifiedirpartitional.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d44447f-5c25-4404-93f3-9eed5654bcb7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cerwilo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cerwilo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ec79ad2-3978-4e87-952f-af6d1978abb5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cesdd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cesdd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26da879d-48ff-4bec-b941-fb20019170a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cevedemine.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cevedemine.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb63da94-3721-4f49-bbbc-ac51607ccea9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cews7ox.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cews7ox.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43bf4e1d-cfc4-4329-be28-9bf4db2bb4c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cezarygolas.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cezarygolas.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ad38bb7-2865-4d3e-ab0e-d7e83b20caad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cezarylewera.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cezarylewera.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b28540d-4acc-481f-9e40-4aa223ee37b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cezaryplocica.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cezaryplocica.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9cb1cf45-8db3-4fc3-9950-e2626ddc454a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cezevaf.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cezevaf.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77fd714f-6fe7-4c83-b682-159aebbfd917",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfopartnersvc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfopartnersvc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f268ba75-29d3-4de6-954a-9927cad6147a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfplzne.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfplzne.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f394dad9-c250-420c-bf97-365dc88781e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfpztwe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfpztwe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--989d8c9e-8918-4ea4-9272-aadf51525b48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1a1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1a1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a29c05f-5703-4ec4-82bc-c73f4c0192bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1b2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1b2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--edd010d8-d519-4574-b510-854eb7ee6587",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1c3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1c3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cf74aa3-2821-4363-bc9f-8022785adeb0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1d4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1d4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a36f6f9-0822-4b50-9035-e7644b8372b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1e5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1e5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0257d200-2a95-4d64-b22c-fa94cf67d818",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1f6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1f6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87c00943-32c5-4f86-b529-f71a35ce5c56",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1g7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1g7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd8d3bf9-a1c9-44e6-afc1-4758c862132f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1h8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1h8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4b31253-6c7c-4de1-bdee-64ee23a897e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1i9.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1i9.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdd1655b-e768-4295-a028-2b3304dfce76",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1j10.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1j10.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b56a8ee5-d7c6-4d1c-8d9a-492688fdc401",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1k11.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1k11.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d71918c0-a0ca-4359-8090-ac0905e2152d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1l12.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1l12.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--854583ff-33c5-4eb5-a9fe-2c151a20e46b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1m13.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1m13.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3012aa52-861a-4122-a956-5ee71406a6f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1n14.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1n14.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68d0fecb-5ec3-47ae-9188-0c503072b83b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cfw000555333q1o15.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cfw000555333q1o15.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--061e0207-ed09-40a2-9ab5-b2e14b75f21f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cgg6nd7dx275ae8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cgg6nd7dx275ae8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7e4e5eb-3ea9-4cb2-8a03-b6432dd1fccf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cgmfrze.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cgmfrze.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6c9b64a-047f-4c21-9da0-239ab4d2d693",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cgvqtyo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cgvqtyo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a296b17-fa61-4874-920c-f2b242f8ff40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chaosaler.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chaosaler.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e5ec9fe-cbb2-4f19-a815-3f75fad7604a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chaowei.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chaowei.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00b2102b-4666-4444-8ae0-709534811224",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: charikati.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'charikati.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e6d8f8f-6573-4b3f-b326-04fe13395e26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: charmius.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'charmius.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4ec5c75-e7cb-40e8-97b2-4c2b31e1f573",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: charmius.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'charmius.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56ecad28-3a2f-42a0-96e4-4caf181359c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chassse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chassse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6b5fb43-2dd4-4c1a-af44-d37cf0a31317",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chatbotworktrain.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chatbotworktrain.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0163c876-08c1-4756-b751-4b1caf2b3e3f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chatgeni.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chatgeni.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7986df5-50e6-4b52-b10f-e67029e2860c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cheatiende.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cheatiende.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de6db3f6-dffb-4416-b05b-f9ca4cd767c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: check-invoice.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'check-invoice.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a99132d-f103-47ba-8d4e-eeb3b8f5c6aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: checkccv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'checkccv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef797b2a-a14c-4871-baf7-5622d7ac8766",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: checkccv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'checkccv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b7fd7a9-1e0b-4e1b-a13b-23a71a827916",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cheet.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cheet.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d104f4b-519a-4170-b89e-3fd1d959f5ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cheet.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cheet.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef8f28c5-fbe1-4f85-81e7-c6d6d9f808b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chega.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chega.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cb820c8-75aa-4d14-a808-39a395952a8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chega.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chega.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f35a478-c167-4fc5-85cb-6a8de7864deb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chenok.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chenok.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--213c0e8a-a87b-4cdd-967b-31e47baacac7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chernobyl-kinoteatr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chernobyl-kinoteatr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--656e120b-3ab9-4b37-92ae-064371f2df07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chhiwate.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chhiwate.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--677a8758-2f27-4d3e-a38b-2cc3ec919199",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chiaf.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chiaf.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59c57134-f41c-4d07-856e-686c4308e275",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chiaf.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chiaf.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddac8105-1967-4ff3-95a4-8eeefaa2fd18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chicken-populari.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chicken-populari.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac0ab7a7-a928-4242-ac46-28b76eb229fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chicwardrobedrape.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chicwardrobedrape.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22c9db6d-26c2-495f-a25f-af5ac6f201c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chiflower.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chiflower.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--312f4817-87ce-47b2-bda2-153446b70760",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chikchikroaduk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chikchikroaduk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--acbeb3ad-a2b2-4e0d-a998-420d5a0510f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: childrens-harvard.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'childrens-harvard.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d16ab99-831d-4c4c-9e27-1e6e523a7e93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chinagrossemperor68.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chinagrossemperor68.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--079b9c4b-d71f-40f4-bd6f-06e8a91541ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chococake.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chococake.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--210a301e-d822-4f1e-ab89-5a88cc04f9d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chollo.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chollo.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d57a784-5e76-432d-9212-c28ef45af25d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chooc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chooc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91a154a0-0c7a-4c42-900e-78f38e196acd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chrae.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chrae.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01f0cfeb-4526-4f58-8b38-d6634645b373",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chrae.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chrae.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--640c46af-5a14-4093-a84e-9158e55ff140",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: christinedavidson.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'christinedavidson.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b080c101-4733-4910-ba8f-9b36d53d432f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chronohaven.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chronohaven.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ffef211-2f1f-4d35-b57b-df0e42083f44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chsjehgk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chsjehgk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b6f17bb-24e2-4420-a5fb-18a457e47203",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chu0v0.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chu0v0.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9cb56591-b125-4bf3-b0d8-57701c95f39e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chuyc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chuyc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea90e25f-6076-4286-b4b8-df70fc7f5a90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chuzhoi-dom-1seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chuzhoi-dom-1seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca186f2d-26a0-41ec-bff5-5ad928725a1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chuzhoj-dom-1seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chuzhoj-dom-1seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d40427e9-a6b0-41e9-a435-69340192783d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chuzhoy-dom-1seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chuzhoy-dom-1seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54be6acd-2e6f-4879-8695-5cee1a5ec4d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chuzhoy-dom-1sezon.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chuzhoy-dom-1sezon.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2e1b4e8-da08-4e2f-b824-9ed6bf722463",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: chuzhoy-dom-1sezons.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'chuzhoy-dom-1sezons.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0df7c035-ce34-47e0-ad37-2e038a34ea5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cifiven.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cifiven.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9236264-20e6-4f01-871e-1480275e77a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cilipao.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cilipao.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd575a04-6424-4e5a-a4ce-76a789c5a25c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cina788-jaya.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cina788-jaya.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b66f43f-76d0-4ca6-9132-2ab4a438375a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cina788-jaya.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cina788-jaya.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46320698-6354-4b2b-b054-3cedc4945bf2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cina788-jaya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cina788-jaya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df12929d-5f02-4d79-96f1-f966aaccb884",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cinarsanmuhendislik.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cinarsanmuhendislik.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cb6906e4-e0da-42b0-9537-011b5f44af72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cine-verse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cine-verse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a61eab8-d4a4-4eef-8b83-0e7aee0d1424",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cinevault.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cinevault.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca96c72f-77bc-4a5d-9aa8-47be0dda8882",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ciscox.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ciscox.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0febf16-ec3d-427d-beaf-df34124f357f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: citiusa.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'citiusa.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc5ac6d6-74de-4512-8d3b-132d57015706",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: civicbridge.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'civicbridge.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e8d7769-18a2-44a2-b7cf-ee7277e445a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: civicpath750.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'civicpath750.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d3b5223-f755-4f08-9030-6f0741c0dab0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cjksad.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cjksad.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--241ae0c3-7ce9-4212-985c-d2f4cc41e24d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cjksads.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cjksads.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--415babd8-b03e-421d-b20c-d70763bb9f08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ckahg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ckahg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47f166c6-19fd-41e6-937c-44d9b5c4f2f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ckplxve.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ckplxve.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1e4cc3b-a0a3-46b7-bb47-9d7b8b9fb3bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ckvphne.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ckvphne.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4309e61-e373-4222-a10d-5d04ac0ee7fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ckzltwe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ckzltwe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab1e3364-d160-4ca5-b871-2795be5ae5d4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ckzvwne.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ckzvwne.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--541815b6-805d-40b0-b6b1-b456c3cc665d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cl6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cl6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b824d2a9-f531-4dbc-acac-fd277657789e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: claia.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'claia.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8fafcd2d-a243-4dd6-a1eb-ff42f01e7c00",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: claia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'claia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8081b14b-c0fd-4438-8b8b-fffe8ad7a179",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clarityaimetrics.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clarityaimetrics.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66cf9f21-24b8-4bd3-ab8b-e3cc88549814",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clarityaiquest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clarityaiquest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a833321a-5a0b-4c04-b1a6-cbdc77d84e7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clarityaivantage.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clarityaivantage.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--462f8110-3737-4a3b-89a6-55681a3b6c78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clarityinspiritcoaching.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clarityinspiritcoaching.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cbd711a-4c3b-468a-9020-9db6cf1e7280",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: claudeandkitten.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'claudeandkitten.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0c8c96d-c1f1-43e9-9b89-ee6a471dd022",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clausaq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clausaq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f6b69ea-b9e4-41f4-8594-6c0057b0bed3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cleanbreak.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cleanbreak.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0dc39008-b828-4a5d-94ca-93a6afbc073b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cleancoin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cleancoin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65300cc4-f4bd-4313-ae08-6404cc035e26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cleandefender.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cleandefender.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4bfd848-6f38-4554-adaf-c17614d256c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cleanlinkhub.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cleanlinkhub.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f2186ae-e707-4182-820b-9a2b3384db76",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cleanvelet.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cleanvelet.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6cc48e94-26f1-4a7f-86d4-c7f980ef0e6c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cleargarden.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cleargarden.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26122bd7-1348-4d74-8b6e-7f11909ce5de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clearpathcomparison.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clearpathcomparison.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--02309d96-2e1e-4c53-a789-9ae77d6b9217",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clearslatevideo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clearslatevideo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b958aa3-2609-4f0c-8fa5-73a576c55035",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clearsyncmail.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clearsyncmail.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15b92e8c-c49a-4727-a061-e9e449dfa19c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clearsynctech.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clearsynctech.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed8ced46-3675-40e1-9dcc-4a22550db6c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clgvwje.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clgvwje.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d8a3100-3913-4918-aa82-610a8d600e09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clickfiesta555.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clickfiesta555.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--81f90a30-b34c-4f22-a139-95d49334b83a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clickmania999.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clickmania999.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--deadb4fb-2d28-4f6c-b6bc-c7ee29eab305",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clickmastermind333.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clickmastermind333.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d33bd27-53d5-4e30-9060-b2398771b909",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clickscale.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clickscale.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--617c2421-4250-4bc3-81af-df3853be5a2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clickskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clickskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fc0c192-a245-4d6b-8a9b-38184ee6d5c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clicktactics444.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clicktactics444.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c95ac1b-7cdd-4065-abb1-423af25b6045",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clickzoneempire789.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clickzoneempire789.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14fdb813-6fd1-4cb2-a5cd-5688404f322b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clipto.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clipto.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80cdb7b1-01ed-45d8-911e-1d833376c382",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: closedai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'closedai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3537449-6e7d-4100-a02e-5947bb16e660",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cloudfyarchive.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cloudfyarchive.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e8fa9a8-a07c-4458-8514-65b20a377b7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cloudfymagazine.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cloudfymagazine.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd0f31a0-5962-4c5b-a9c5-c2649a35b678",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cloudfywebsite.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cloudfywebsite.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4db2a792-fd66-49d2-984c-0360e93d1be4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cloudly.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cloudly.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d176ced3-02a0-4b19-9c51-7f29ebe79ff7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cloudrix.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cloudrix.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f6b3f04-8937-4410-ab6c-850929741f5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clphjre.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clphjre.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5d3063b-f87f-476a-8ee0-6537d959a63b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clphzxe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clphzxe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab670c1e-625b-49da-ae14-ab8f9460a2f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: club-jetbet.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'club-jetbet.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--550a48f5-e114-431f-87b5-6a9696f2437c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clustering.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clustering.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a2c0d83f-308d-43fa-83ee-38f71744961b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clxhkne.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clxhkne.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ff9ccc8-64be-4645-b2c4-704263c4a977",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clxrkfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clxrkfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c135d25d-37e7-422d-a22a-86f59054d88b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: clzmwpe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'clzmwpe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2de74340-fba9-4574-b79e-ebb413360fbc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cm2k2n6ayrbs6qw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cm2k2n6ayrbs6qw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3dd96cd-5c3d-487d-a928-f8177ba5679e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cm957.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cm957.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5944abab-89e9-4ee2-8700-ea6201eb5657",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cmrfgjn4sfanan5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cmrfgjn4sfanan5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--228b9d7b-06e7-4827-9d97-20b8afb56ec3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cmrwrd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cmrwrd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--544534d3-1bae-42f9-ac70-bd4aa19a377b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cnf.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cnf.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fff513c-a9fd-4fb7-ac87-dd7c3b8c2584",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cnlygfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cnlygfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8c8f1fc-65e8-4075-83b6-52c29a29eda7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cnpjmfy.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cnpjmfy.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e50995be-4846-40cd-881b-1ff50d2a1699",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cntvip.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cntvip.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4802232b-4a48-4f5e-b0de-601995ebc39f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: co1fhhkhpg-o1g7lrzn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'co1fhhkhpg-o1g7lrzn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b4c26d8-bf7f-45a2-a644-709fe1c59fde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: co367.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'co367.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f8b2f0b-4c0d-405c-b66a-84581d4f12e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coachingspiritualguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coachingspiritualguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23391442-de9d-4768-8bd3-45dca077c51f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coalescecourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coalescecourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ada4a89c-8a03-40f0-97c7-6481e3dfa021",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cobarlonilonaxe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cobarlonilonaxe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eaa4bb01-7749-4f15-a3b4-f3e59d00c04c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cocaney.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cocaney.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d3e25ec-7e4e-44bd-a21a-7312902423ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cocieteg.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cocieteg.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06c7b1ab-ad32-40f7-8537-561e4265b43b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cocieteg24.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cocieteg24.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dafe6baa-e061-4156-8c8e-6a78dfa15941",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: codeccariiqamave.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'codeccariiqamave.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e115ed5-4eb7-4ee8-943d-4cb4644bb392",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: codelumen.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'codelumen.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99658b00-2128-4ce0-b4c3-9e6796edcd61",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: codestudiopro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'codestudiopro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c069442f-770e-4cd8-8748-21f6fe3d836e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: codexis.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'codexis.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4128aff1-9c6a-49a1-a92f-1b68523806e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: codice.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'codice.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fd63b51-86f4-4e08-a755-0afce5a07e63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: codulxagoelari.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'codulxagoelari.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--02891d7f-4347-45b0-a0d4-91d4a1219c2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cofluxum-8-lomatrixix-lozenus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cofluxum-8-lomatrixix-lozenus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f40d789c-ad55-4db3-820b-cd4b2adf4287",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coinbarc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coinbarc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31a555c4-d791-44d3-a0b1-53e8f106714f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: collectivevideofocus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'collectivevideofocus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe9cdbcd-bc8c-499f-a614-e59a35cd867b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: colomon.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'colomon.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d49cc1ee-398e-419b-8408-419d949ad5fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: colorgame.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'colorgame.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ae92ce3-8bf1-4050-87e5-9a8197ffa46b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coltatshipcatormalashord.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coltatshipcatormalashord.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41007c02-83d0-4ef2-bc3f-c7bceee11e70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: com-4338252.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'com-4338252.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19a346ad-657a-4c13-8d9b-88794eeab20a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: com-4338952.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'com-4338952.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c03d744-e899-41ac-9868-4d8ef11f0ee2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: com-kazzj.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'com-kazzj.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43f02e4b-f675-4f94-bcf9-b5739b7597aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: com-kazzs.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'com-kazzs.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17ddee5e-c211-46a8-a340-8f6b74387c57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: com-kazzw.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'com-kazzw.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9cb29fd8-f21a-4260-a9ce-73e2d397a18b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: comn8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'comn8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79a2cdc7-a768-41f5-8d9a-2ed8442dee23",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: comonseure.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'comonseure.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27590abc-f4ce-43e7-99d8-195656edf9d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: comorsexiofani.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'comorsexiofani.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28946c11-6eaa-4ac8-b2a6-1207134c34bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: comparetrustwave.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'comparetrustwave.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78afe573-91cc-4095-8f38-287a0da43bf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: compareversity.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'compareversity.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eecce173-6e50-4954-b62c-bf25ae823621",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: competentexec.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'competentexec.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b003d58-2966-4278-b91c-fb68f831fdbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: complete-fast-1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'complete-fast-1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8accb570-9f2a-4f22-aca2-f93a75869453",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: completecoursesphere.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'completecoursesphere.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--856a90eb-d968-49d7-89b5-4d8396da89ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: comprehensiveexectraining.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'comprehensiveexectraining.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e50bcb81-6a33-4cf3-9760-0a9dc75800bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: concordiawe.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'concordiawe.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b534401-2441-4787-bcc9-86ec6fa488b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: conecte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'conecte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c9cb26e-8897-4386-8db8-6fedfe4a32a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: confin.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'confin.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f53b584-b7c0-4fdd-9ad2-1067a77eb39e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: confirmation-secure-booking.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'confirmation-secure-booking.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74ed0773-dee2-4c08-b5c2-526faaba380b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: congtogel1dfg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'congtogel1dfg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--064d831f-3445-4137-aff6-4356f1d7c4b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: connecta-network.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'connecta-network.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41d547b4-32cc-4031-afd1-7b0fba5d1f05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: connectivitycourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'connectivitycourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a6b6715-dc27-4054-af91-284cbcced12a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: conoositesgowem.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'conoositesgowem.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43d57a6c-0e0e-4e0e-92e3-187c2d319de1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: construirbuildedificio.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'construirbuildedificio.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9fd2eb7-2570-423f-8a79-3d2862f044f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: consultavitual.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'consultavitual.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--530165a1-b34c-471f-b9ba-2b9a1c430c53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: consultoriasfr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'consultoriasfr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65f99bcd-4c9e-4fe7-9488-293993d36f2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: consultoriasz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'consultoriasz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0b6d813-2dc8-42bd-b04b-3ad81601ada8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: contracrot.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'contracrot.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69835af2-a4e1-4112-acff-1ffea1e46aef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: controllpa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'controllpa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50fc932a-0782-4228-9d29-670f5bd4ebdc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: conventioncouncilsmany49.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'conventioncouncilsmany49.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62d9be36-7ec0-4e52-97d4-46d26351f887",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coolset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coolset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3fb2ffd2-2c8a-4efc-a286-e5fd6b1e95ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coolskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coolskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19dbb50c-1f36-4903-a241-fcca08051b9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coorbito-m-depixela-fimatrixus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coorbito-m-depixela-fimatrixus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--94c439b7-c8e4-4a84-9369-a8868c87dd0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: copaprint.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'copaprint.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--222a4504-19b6-4a57-b34a-e4f51948c6e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: copperwillow.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'copperwillow.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b689758c-a2a4-4463-80cf-f5a446bc4e1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: copterpix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'copterpix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4915045e-d5a8-4e0d-8f99-05faae6008d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coraleb.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coraleb.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9e334048-3ba4-42f5-9bf9-75327a0e16e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coralnexai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coralnexai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13551f09-d5ef-4e48-8371-4d1062d3f308",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cordani.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cordani.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9012625c-171f-4244-b15f-f7e5554d501f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cordelis.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cordelis.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73167128-83c3-4b51-a79d-63530ab1f954",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cordreview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cordreview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e31767e-34ed-4e03-986d-4687584ad844",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cordreviewbrand.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cordreviewbrand.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea5d26d8-d971-4c8c-ba08-0bfa97b66389",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cordreviewbrandpromote.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cordreviewbrandpromote.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06768138-889b-46eb-9745-e93936d80ef1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corecraftedcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corecraftedcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2d0d31b-732f-43a6-b330-507a18aa6872",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corespiritualguidance.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corespiritualguidance.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f2b436a-5be3-451e-add8-645004c2d7bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coresyyco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coresyyco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee18652f-def2-449e-8586-5febb77187df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corihimepo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corihimepo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0f71162-4a4c-4e9e-83cd-8dca3e921b22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cornerpocket661.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cornerpocket661.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d4abacb-e704-469c-be6c-eed5bd0700db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corpdeclaration.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corpdeclaration.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--448db739-d7c3-4bdf-924d-57601b00e8dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corpfinanceofc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corpfinanceofc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21dd13f0-cb87-4273-afa2-7f7ee235c404",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corrcos.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corrcos.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--033d45a0-eb19-4010-96c2-dbaa8724070f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: correoas1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'correoas1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--200f84dd-8ba0-4318-977e-908a9d909fd4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: corunvemor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'corunvemor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29dce3ae-1162-45b2-b315-772e797ced31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: costumeorcanet.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'costumeorcanet.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb250446-c573-413d-a02a-99a2b90adf8f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cottiervested.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cottiervested.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df46e149-e741-441d-912a-9099603c5584",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: couponvilla.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'couponvilla.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a34f039-e336-44a9-a920-6c59c621de37",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courriersecure.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courriersecure.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac9eb98f-0107-4f13-a73f-cd55186d4d5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseascendance.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseascendance.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b70b7f5a-e979-47f3-9231-8c4b5e8c57a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursecatalystlab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursecatalystlab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0aeb1472-2ec3-41b7-ba49-71002fd62075",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursecatalystway.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursecatalystway.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61ce222e-ed14-476f-bb7b-35377d601417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursecultivation.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursecultivation.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50a4a31c-a265-43c2-b1a3-678cb8d76d14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseeagle.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseeagle.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c595f16-249d-4e92-b7db-f438cdedd3b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseefficiently.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseefficiently.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71e56782-0463-4efb-b123-ae3a138eb2d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseeureka.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseeureka.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--784b7b2d-9c6e-4d70-99d8-09fccdfd0259",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseevent.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseevent.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37fb04a2-f119-45b8-9168-6b7d8ea98400",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseexpansion.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseexpansion.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a2144e06-d277-4ca6-8240-65773dbf7cfd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursefirst.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursefirst.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa08c1d3-3477-4841-bcdb-bf8c5d0cda5d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursefusionessence.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursefusionessence.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7ba19d94-76a6-4745-9137-063277baf50b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseimbue.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseimbue.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--186c8d5b-bb89-424e-afbc-1e1a853b4da8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseinbox.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseinbox.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f4373df-adfd-4a7c-a117-4048b63340a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursejockey.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursejockey.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea5aeae7-e844-4c4f-a183-689d14624c59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursejourneys.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursejourneys.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c3a0ddc-dda6-4503-8ab6-5df8d83a2d5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseneuroscience.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseneuroscience.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b3dd2c8-2440-4ab4-b6fd-84a7bb8828a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursenewground.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursenewground.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c81d67e-f96f-4734-83f5-6eb8d9d8dad2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursenurturer.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursenurturer.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe35c7bd-c21a-4afd-8f23-780c3901cafa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseoasis.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseoasis.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--881e89e7-df0f-4814-bf7f-4e0243b1872a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursepathpro.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursepathpro.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b36baba-2c13-45ea-a2e0-7a508067bab5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursequadrant.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursequadrant.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--824b831d-b71e-4ef0-883b-109153058c85",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: courseredefine.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'courseredefine.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c338126-7bfb-4d60-a2ad-fcfbe5e13fd3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursescape.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursescape.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b83588b-2b09-4188-8e4d-8d361c42f5b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: coursetrustfactor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'coursetrustfactor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d0e796d-0cd1-4c46-93bc-0e8b46c6792c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cow-protocol.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cow-protocol.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--994cf04d-19a1-463f-bc3f-c147b4576f19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cpwhyla.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cpwhyla.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c672f920-32a1-4d90-aa61-8b877d361df7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cpyboble.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cpyboble.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d52ae2f1-057d-415b-9742-b0e3dab6c789",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cpynvla.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cpynvla.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f3b460c-7786-42c1-9c30-5aff7eb1b829",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cqlt46435880l1a1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cqlt46435880l1a1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e51d2834-34d5-41e1-a109-9df676953b13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cqlt46435880l1d4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cqlt46435880l1d4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d82b5588-4830-4c37-ab73-b3111e6f8f1c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cqlt46435880l1g7.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cqlt46435880l1g7.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b57d210-9f72-45e8-a546-dc77c6d028e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cqlt46435880l1j10.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cqlt46435880l1j10.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b73e63e-c714-4ef2-a156-bf3a8e785cd7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cqlt46435880l1m13.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cqlt46435880l1m13.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28553ef7-ad88-4360-9505-74f352700b04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cqzxptn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cqzxptn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f664db6d-399f-4a52-a468-575b1ce6ee78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: craftedcourseplan.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'craftedcourseplan.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90fe0067-6efe-4689-a029-1978e1c4a514",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: craftedforcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'craftedforcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3919519-4a2e-498b-b6f6-82820770cc05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyal-bet-guncel25.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyal-bet-guncel25.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--033a92ae-ca26-412d-8d37-13588b9084a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbet-7temmuzgiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbet-7temmuzgiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3063f47d-768d-4679-85fa-0a68fae2c6d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbet-com.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbet-com.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fa3c145-1e37-4c72-b66f-4c333eccbd40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbet-erisim.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbet-erisim.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7682e5da-418f-4da0-b7fc-8a54b0e1015e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbet-girislertam2026.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbet-girislertam2026.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85d5039e-586f-483a-a53f-479fc35ed48c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbeterisim.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbeterisim.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--644f5c09-fc07-42af-92cc-40f453f57b67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbetmobil.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbetmobil.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24f72685-2a28-40e0-a7fe-f50623aaba75",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cratosroyalbetturkeylive.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cratosroyalbetturkeylive.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13734b52-1d6d-4fb5-84a5-87bdc8fa109b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cravelo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cravelo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d4624d9-cfdc-4f3b-bc42-61c5b0d89965",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cre8exectraining.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cre8exectraining.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47acdb56-e63c-43c7-ac18-a28a185d0903",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: creatorgisincreasing67.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'creatorgisincreasing67.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e5b5426-be6a-4169-b903-ad20dbc4b5e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crediblevideoinsights.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crediblevideoinsights.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--461d9fe3-b97d-4ea3-8ad0-ffbb9a2580ab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: creditoenlineaweb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'creditoenlineaweb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3f3a286-0968-454b-a118-3c10c0f2ab34",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: creekloop.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'creekloop.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1c439bf-aaf5-464e-8b4e-3b10cfb923b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crestpropyhse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crestpropyhse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--991af7bf-fc59-45a6-8a0a-a9d758ef3c11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crewskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crewskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31b5e648-e440-4249-af46-cdad523a84b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cricketklubben-groennely.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cricketklubben-groennely.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee0e9008-9d7f-4324-ae90-899e1f00c29d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crly49.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crly49.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5e52f7e-f327-40bd-97d7-63a3299cefa3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crly50.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crly50.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b977e21f-d3ba-4f1f-a7ad-cf857b049325",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crly51.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crly51.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b833834-b95d-4749-8d92-057464455afd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crossprofitdevel.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crossprofitdevel.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--982570f9-9b95-4d55-bb8b-d7e980f3537f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crowmail.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crowmail.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b0845fa-da08-4b7b-9f58-41d663ef53a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crownvideonetwork.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crownvideonetwork.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba7cc337-877e-4a81-8bbe-7be153237e73",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crqjnvo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crqjnvo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08aef052-5fbd-4661-b36c-6db93ad8dd51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crqwgfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crqwgfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79eb5537-e176-4c93-b271-fa68b2dca600",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crtgvleas4yimf1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crtgvleas4yimf1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--289baea6-2b3a-432d-aa22-043f6ef3240c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crumblepg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crumblepg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a691851-d5c2-4d25-ba60-57ddac6c6fad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cryptovia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cryptovia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18fe2c95-7e5e-4e72-96ac-336aa259034f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cryptovx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cryptovx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcfa8e34-7a55-4fb4-9512-ee8aa4862bab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cryptowinter.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cryptowinter.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26efb2ff-c3f2-4ff1-b863-0992ba0cebb7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystal-boost-winonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystal-boost-winonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d352991e-f353-4134-bd45-03a02b2e0b39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystal-boostpayment-kz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystal-boostpayment-kz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--007f5199-eafd-40b5-9adc-ff590abf02b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystal-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystal-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64ff4035-ea67-454d-a548-3fd26da3c47a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystal-kz-boostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystal-kz-boostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04a409cb-3923-4d7e-80b8-0332d1fa9648",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystal-kzboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystal-kzboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--726d54f9-d8ba-42ed-af2a-5a98ffe6155e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystal-startboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystal-startboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ef68789-4061-4a01-838b-cd3aee290fa9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: crystalvideopros.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'crystalvideopros.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--015189d8-fd96-42b9-98c2-120e31274e2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cs-twitch-event.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cs-twitch-event.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a376621-307e-4da4-ad2a-df6255ebd2f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csikr4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csikr4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8b50d38-5749-4f16-a52b-0378f2f2cf2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cssbuysheet.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cssbuysheet.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0cd9a9d7-4141-4ef5-a37e-128b08c647d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csspx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csspx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4204caca-2097-448a-809d-ebbfdaa82d2b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cssspreadsheet.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cssspreadsheet.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf201383-7c9a-4d7b-90ca-d7d09fd559dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cssspreadsheet.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cssspreadsheet.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34a7b591-38a6-4bea-8ba7-152b7ad5736d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cssspreadsheet.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cssspreadsheet.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22754dc4-7868-42b2-8dd8-cefd9606492a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csw1222111880j0b2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csw1222111880j0b2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfc1675d-6ff3-4d7e-8e2f-053311c7bcd4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csw1222111880j0e5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csw1222111880j0e5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6785299-066a-47df-a0b6-1a77a099421a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csw1222111880j0h8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csw1222111880j0h8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12713ee4-bc50-46c4-8b38-c23e37e7ea65",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csw1222111880j0k11.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csw1222111880j0k11.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a2d5e4c-1433-44ff-b333-e7965d0c9c2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: csw1222111880j0n14.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'csw1222111880j0n14.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c19e2e3-4826-4ef2-96a8-9e6bd0f3e59d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ct127.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ct127.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5554bc9b-6728-42f0-b07a-17b5470e02f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ctfllc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ctfllc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6ea43a6-fe0a-4142-9f0d-3896ac47ea2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ctmzhke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ctmzhke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34383efa-9e87-47a7-b8c9-2c041c6ad993",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ctxphra.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ctxphra.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe72e059-6b88-471c-8f47-03b92964173b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cu-login.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cu-login.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e82101b5-2bb0-41a0-952f-4bda7709a374",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cuanrtpcapital303.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cuanrtpcapital303.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62ba8f1c-4e62-4318-84a2-56f10891973a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cubaftihegeeonefate.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cubaftihegeeonefate.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d412e3c-d2a4-4133-b814-88d4026b78f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cubimcodofeazimi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cubimcodofeazimi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--78692e99-1679-4f64-a95b-1077fae46c3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cufisdacemosa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cufisdacemosa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b21192c1-1705-4cdd-8c42-f39e389cfa76",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: culokor.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'culokor.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50905584-3c14-47cd-841f-d051648e6f39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cumbrsoli.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cumbrsoli.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75b6cb96-7bb6-4a12-b26b-76765660ea6d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: curenvociraefovo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'curenvociraefovo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a254a88-f7c8-4283-8ffd-898b3dc077b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: curupiratss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'curupiratss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f71dab1-d7e8-4a55-9ab3-34b46a6e44d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cusc7y1dw3yhlmk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cusc7y1dw3yhlmk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b768b777-fca9-49ac-b987-4a087c309117",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: customer-control.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'customer-control.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac64bd85-7efe-4b99-8eef-2e31af1efba9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: customerinlove.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'customerinlove.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a59caa3b-a34f-4774-8ce8-0efd90518157",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cuzicac.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cuzicac.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b95d730-7603-4880-a98b-73d31af1cac9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cvy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cvy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--139a5027-2ed1-4ec1-8e62-5e91b264b7af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cvzlhke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cvzlhke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82ec2cda-aca9-4856-979f-5f0a49b5fa48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cwhpzme.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cwhpzme.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ef15c93-5503-4e4b-adf6-945acd40599e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cwvlgfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cwvlgfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8085fe60-c0b7-490c-bb68-5d0793d499ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cx2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cx2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--568f4f46-3f5a-46bd-927d-3fe3c79895ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cxqss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cxqss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--664d5203-30fc-4d33-be47-73d66fece266",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cxwzvke.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cxwzvke.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fde2ff6f-1fe4-42cd-a8cf-c3a42b31434d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cyberawarecore.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cyberawarecore.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5dca65fe-9669-4890-aa1c-dd6b63f8701f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cyberora.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cyberora.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b0631e8-533b-4abc-927a-ccde98b72385",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cyeghhjgks.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cyeghhjgks.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a1bf3ab6-89b1-46c2-b96f-20c40a291586",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cyin1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cyin1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a2da9e7-6171-4cc8-9ea2-346e79e5eaa4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cz-gls-group.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cz-gls-group.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74d866f8-6e2d-42dc-88c6-ca852abe4e5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cz4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cz4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bff1b85c-1d09-419f-aacc-ae5ab139d7ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cz448.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cz448.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f06914fa-0eea-4e40-a9ad-f7db7de8cd44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: cztplwe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'cztplwe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84da5578-58ce-48ab-9b25-276c2970f3e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: czwiu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'czwiu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--516458fb-d4e3-48e0-81b7-6752edc210d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: czystygrob.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'czystygrob.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b8fe4dd-7206-4158-b3ef-8d7e896cd7a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d0ibr.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd0ibr.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--130d12cd-4ce6-45d5-b3a5-8b2faade12bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d0n.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd0n.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--191cd31a-389c-4268-8bb8-3d2c7fbb0288",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d16888f.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd16888f.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55eb4279-4e45-44f3-bac3-8d956dfd4deb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d246sgp8s2.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd246sgp8s2.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--222b2d53-129d-4711-859c-dfb2cddfaeea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d3gfdfdf.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd3gfdfdf.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9af5656-3e62-4772-80c7-54dbace48c09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d3gfdfdf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd3gfdfdf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5871a23b-a59b-4b62-8790-77e09ff54d93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d3x4sgpa3a.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd3x4sgpa3a.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ade15db-b9dd-494a-ab9d-4ef8942f6aac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d41.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd41.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f86935fe-33f2-4fb8-8621-37ba0cb3882b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d46.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd46.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c04ef197-9348-4a64-963c-e1cda393bb87",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d4b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd4b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df4ecf5b-973c-469e-ac75-e994dd42e094",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d5qg7so.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd5qg7so.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54099b4f-bbb2-47dc-8d67-444ead52d0a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d6d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd6d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d07d962-3705-4b86-9138-596dc5397e7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d751f924c3b291540bcac9972477c740.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd751f924c3b291540bcac9972477c740.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab723fce-59ec-4c01-93de-4dd82a4973f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d777f.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd777f.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e0a0100-e2f5-4fe1-ac5a-574a7b72e218",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d7o9z.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd7o9z.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3bdf1bf-7929-4816-984f-d6ecff56291b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d7s7y.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd7s7y.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61d6e879-7c04-4944-a181-e15288f6aaee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: d9t.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'd9t.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55f129e5-7281-4da9-9715-fb8df21054fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: da7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'da7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c124bfdc-1058-4517-b5f1-81aa03b1093e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dacoityyawnups.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dacoityyawnups.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--012d65db-a526-4fa2-af0b-aece9ef062b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dada100.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dada100.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--558a5e25-ff1d-4541-8874-2be6a3fbc145",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dada98.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dada98.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c684b6fb-0942-4748-accf-9fb2a9bd58a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dada99.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dada99.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d485cb1-93c0-4d90-bdfe-931405df173b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dafumor.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dafumor.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98a53452-c47b-4c81-b37f-06cbae33da90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dahilzeviifeno.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dahilzeviifeno.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89f49883-c622-466e-9264-517af626905f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: daidai.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'daidai.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab6d7284-2517-4d00-a248-8cec93111aab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dalagarasterlowbred.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dalagarasterlowbred.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--384ea541-824a-4d16-b254-777cdca95917",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dalajkopezeeoajehi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dalajkopezeeoajehi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3de5c6b7-e54c-407e-93fe-6942905f956f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: damaiteca.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'damaiteca.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e733f61-1186-4e13-8c3c-ba5f6420ce6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: danalrasaaicogo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'danalrasaaicogo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ed6161c-10af-477a-b0fc-7fbe1ba8d05c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: danatotoh0kii71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'danatotoh0kii71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8c180a7-814c-4cf6-b169-49bd18eb5c12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: danatotoh0kii72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'danatotoh0kii72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3403b530-0564-4e1f-8994-0b84c7214fb5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: danieldudziak.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'danieldudziak.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--723c3b05-89d8-4976-a88b-64a825fc2911",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: darelqorix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'darelqorix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--030b6904-0b7f-411f-b09e-9bd827dfce5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dariadziwinska.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dariadziwinska.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2e57d4b-bb7f-4347-a226-9de9269cad6c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: darkcloudzone-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'darkcloudzone-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--815882fa-e76c-42d2-ab7e-d570f1de83ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: darkroadhub-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'darkroadhub-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5353e4d5-d7b8-49f1-8cbf-8817000917b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: darksparklab-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'darksparklab-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--becc3ead-3332-4464-b258-316bb8a013a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: darkwolfzone-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'darkwolfzone-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c21e5f6-b22a-453a-b0a1-aba75c1048e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: darnex.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'darnex.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ef394de-4710-4d71-a30e-e97459f32fc7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: datagridy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'datagridy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53755586-e6d9-442d-9ab6-b36edce626af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: datingdvoe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'datingdvoe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb79c2a5-039d-4de1-a163-4266a125d883",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dawidklein.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dawidklein.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47ae9e1e-a7af-46dd-8f6b-dde2080dc885",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dawidmaroszek.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dawidmaroszek.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--192df71f-d510-4c48-b0c1-c5d98fc9c9e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dawnridgeway.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dawnridgeway.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58544d55-e1d4-4f2b-93d2-0b2e1517b9bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dawnstarssummer.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dawnstarssummer.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32502cf3-a51c-472b-8cf6-1caa213f48b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dayames.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dayames.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c919539-4b2a-4663-998c-3876b0d86ae4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dazirharofeifoba.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dazirharofeifoba.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec318f77-32e4-414d-99f1-104c15dec463",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: db319.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'db319.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6940e99-2487-4963-b294-4e677cf9aae8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dbamogrob.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dbamogrob.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba85fb1d-0330-42d1-a78a-17cbb53d8c5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dc3xsgpsa7.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dc3xsgpsa7.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--653f6ab8-d503-44f6-a8bd-7be5a7920426",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dc4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dc4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f257f82e-18ff-47c3-9ad8-e62705de24a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dcsihg-gosv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dcsihg-gosv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0b7c4eb-40db-479b-9eb4-dea9f190e79f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dd6msyg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dd6msyg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db5a0e6b-9d29-44eb-9ae0-deeeff5f7eeb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ddecv001.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ddecv001.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61de96ba-8c4b-4b4f-bc5c-6400af70f6e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ddecv002.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ddecv002.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d30d570-0b4f-4765-bbbf-53edc88269dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ddyyy.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ddyyy.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--863df463-67cf-4c43-8aa3-4c6a0432a1ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deadairvt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deadairvt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5248ab96-6287-419f-a4a1-363e5084d092",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dealerclocks.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dealerclocks.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b32be8e5-ce62-4be6-b42e-60dd0f7573bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dealorigin.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dealorigin.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a48c11eb-5ec5-4d63-9f53-026d8b080569",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: debitedillegaljaburan.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'debitedillegaljaburan.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2083bf64-0352-4fa8-ac2f-a6b4ed068018",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: decalpimfe.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'decalpimfe.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--843c1169-3d4c-4609-b298-60be243b927c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dede-bet-resmi31.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dede-bet-resmi31.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8536af3c-e324-455b-bff6-e7faf4b06ea1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deepface.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deepface.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72bb54db-ffad-4e9f-ad7e-70b18ce96b6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deepnesocketet.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deepnesocketet.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de56f787-b555-4f74-8279-4d2f05754b9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deepworkroutines.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deepworkroutines.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0658379-42e8-458f-8fd7-9b2252da7e72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: delebcoarokasi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'delebcoarokasi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1cb0b62c-d20e-4b7b-8c3f-2adbc5fc2eee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deltakimya.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deltakimya.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45490fad-6d1f-4e88-9413-76770b0c4b99",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: delur.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'delur.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62183b65-6c86-49f6-8a9a-4a0258932265",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: delur.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'delur.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b340dbd8-067a-41a0-a1b7-d7866c0688b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: demavxegedu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'demavxegedu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e5a698d-dd09-4eb9-8e72-0d00e28e0c7f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: demis-i-marina-onlayn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'demis-i-marina-onlayn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c429abc7-7624-4e64-bb09-b0f6fbf5db9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: demivheosocuda.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'demivheosocuda.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddb2129b-ecac-4151-bd84-f1c192ba7f64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deneme-bonuscum.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deneme-bonuscum.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4d2f952-e58a-48d2-9d9a-626cfff690ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: deneme-hemen-al.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'deneme-hemen-al.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2977e1b-4f5d-47c9-a843-76e226fb9fd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: denemebonusuuuu.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'denemebonusuuuu.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a769c2a-0c46-4f98-884b-941a91d2b1ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: denqu.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'denqu.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a218b1b-b66b-4e21-8c05-fe9bdf6d2753",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dependablerightslaw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dependablerightslaw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7b6801a-0c18-477a-84f5-0b48c491ea6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: derexcodaaragaco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'derexcodaaragaco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73a80705-1b5d-4c61-80d3-4afd96a49a3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: descubrecolombia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'descubrecolombia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fe10a5e-e386-482a-8fdc-401f06a2beb2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: designertome.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'designertome.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df84ffc2-53db-4dfd-93ff-26d2d9d7e593",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: desigroup.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'desigroup.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1643019-ff4c-4740-b1fd-d990c5f27626",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: devushki-s-makarovym-onlayn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'devushki-s-makarovym-onlayn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fcfe746-330d-4990-a714-d67a55cd6b4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dewi88gcr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dewi88gcr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f849e98-7aef-4d39-bb2d-5a2aef6b9b38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: df809.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'df809.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--546af4ff-d0a3-4ba5-b355-d907ea2fb533",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfc44076198j0b2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfc44076198j0b2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f92f9058-5d2a-4fe1-94f2-d38cce23a6e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfc44076198j0e5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfc44076198j0e5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9e3d5adb-b41b-4a1a-86af-228e8e028b2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfc44076198j0h8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfc44076198j0h8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7538601a-63c9-4a3d-9a3e-5b4055c6de88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfc44076198j0k11.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfc44076198j0k11.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac9a6122-65bf-4017-9926-b6bd381f74d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfc44076198j0n14.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfc44076198j0n14.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--597e18b0-802f-426a-b958-97b4764c8365",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfft-28.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfft-28.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48d46a16-8a7d-4ced-a748-1c4e014808ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dfvsv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dfvsv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ff09574-a449-4735-a752-e6a17eee6900",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dga33413880i5b2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dga33413880i5b2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a340204-3b0a-4ee4-9bd0-e8d5d0ff9bdb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dga33413880i5e5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dga33413880i5e5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe9ea760-da22-4e17-8216-6e194d28c411",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dga33413880i5h8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dga33413880i5h8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c15d252c-e48e-4e0c-9825-ab03f9cc93c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dga33413880i5k11.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dga33413880i5k11.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71ada79c-cef1-4a7f-b8b1-7973f33c73d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dga33413880i5n14.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dga33413880i5n14.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4af29432-2cca-4820-9a5b-00d4b88b7ed1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgb-bbin.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgb-bbin.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e0278d8-4514-4de3-bc19-4de80c2c7cce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgb-internationality.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgb-internationality.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7312fcb4-3661-4558-984b-5c81eec2e9df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgb-lol.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgb-lol.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8bd0298-9b21-4451-8ae3-b0739a140c0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgb-star.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgb-star.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--185d5685-1b9b-4c85-aa7f-936e08d9c8d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgi-careerglowpro.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgi-careerglowpro.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea5d0946-19f7-4df3-b12a-f232e97354ab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgi-skilljourneyhub.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgi-skilljourneyhub.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5cc52384-d90e-4a89-8bd1-ecd1589d1d4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgi-talentforgexpro.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgi-talentforgexpro.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69e5747b-3257-42df-930a-df2fe43308e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgnnsia-gosv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgnnsia-gosv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15b3753a-3e82-4eba-82ec-1d87621724da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dgx29g.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dgx29g.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f422b6c3-62e3-4868-b343-480059cebc7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dh4gizq.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dh4gizq.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f8f9a02-e55b-420c-afdd-c95b3eb8a142",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dhubmov.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dhubmov.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffa21584-eb3b-4c32-9210-5b67aa07bf8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dianearchitecturalfool27.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dianearchitecturalfool27.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bf44469-3b96-4088-82ae-8bc57c02fcac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dianegroup.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dianegroup.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1101b6d1-7199-44cb-acc1-9c9f3d638601",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dibigsasojeeokehi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dibigsasojeeokehi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58fd745b-ff3f-4116-8a58-6be1cc75b041",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dicona.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dicona.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13184338-658d-4e93-b95c-4a59337be749",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: difficulstack.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'difficulstack.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14c45c43-f76c-47d5-9bf6-16823aa00dcd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: difficultyranking.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'difficultyranking.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8174023-cbc7-44d0-9df4-7adb7f5c54f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: digitaien.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'digitaien.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30c55856-7cd0-44b0-9db9-e2e403107aea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: digitalprime.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'digitalprime.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3995b344-b5b7-4f1b-890a-ce41308db660",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: digitval.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'digitval.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f027e51b-9df8-43bc-bae9-7dc37ca01618",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: digitval.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'digitval.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7cd3ff5f-87bb-4ef4-a914-825eb98c6ed9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dignityvideoservices.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dignityvideoservices.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7bbd93a-d283-47a8-ad63-7e8843157882",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: digovsurore.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'digovsurore.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--859ae74e-ce95-4a72-b3b8-a201482b1fb1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dilibkabejearecopa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dilibkabejearecopa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0edbebb5-3cf6-41fe-bbdc-9a1bc5d7184f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dimikpekonaiqapane.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dimikpekonaiqapane.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9569757-b51a-40e9-be27-280d502a1fc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dino-novinka.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dino-novinka.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5b5b414-162b-4622-85b8-75a89b2e6f88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: diors.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'diors.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a56974c-12f6-44c2-95df-8fd4e267a0d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dipicebumo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dipicebumo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15b3a327-8d71-412d-91a7-fbf389b56432",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: diplattep2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'diplattep2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e50bbea-e5ae-405f-91e1-9391e4e2269d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: diplom77mj.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'diplom77mj.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80fb32da-6391-4d12-b939-41a066585759",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: directconnectpod.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'directconnectpod.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2db74183-8aff-460a-b7dc-1ea95cb9aba7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: directormastery.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'directormastery.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a3dfb8b-cf8b-47c5-8426-cf09d0cc9e17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disavtetalehepa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disavtetalehepa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6bf5d3c-dd5f-4c29-83cd-46f2ffc06354",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disciplinecourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disciplinecourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0b4b423-467f-468b-9d24-3797a143da38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: discordzapretka.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'discordzapretka.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b90f7c12-dbce-49e3-a38d-e2d95ff00ae3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: discovers.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'discovers.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a67fb775-5979-4909-bef1-b5a150092d33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disedgechiggerjessed.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disedgechiggerjessed.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d72dbbc3-6af4-43e2-a067-a32b675d721b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disicoundsftx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disicoundsftx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a45335fd-1e66-4719-86e5-624e9a57b81f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disormacro.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disormacro.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--191130ae-0609-41b6-a332-ec6e05ed5c5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disreco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disreco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5110686-6997-4d1d-b1d9-7f3b927ff556",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: disz88.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'disz88.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c231b434-3a11-4954-8c8a-ad4b13accacb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: diuran.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'diuran.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6a0f215-67f0-4d95-b2a0-086aea06c08e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dividend-ntiu.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dividend-ntiu.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0db5cb1-070f-42b5-8860-7c684bda3c33",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: divineempowerpro.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'divineempowerpro.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a6a2b22-d743-413b-b433-18dc5e5b0041",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: divovroneroviegogo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'divovroneroviegogo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--786872d9-3163-42f3-b0e0-9be738a7caaf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: diyhomerepair.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'diyhomerepair.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bec0b294-22b1-4bcd-8039-9080a5833d2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dj91584.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dj91584.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99cb44b3-c509-4cd4-a6a5-2960be7a59c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dk-produkt627926.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dk-produkt627926.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6107ef6e-c2d5-40c8-9c26-3f24cfdbdebc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dk-produkt927428.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dk-produkt927428.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2237696-b8d4-4269-ac44-b9653d405dc9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dkeg18.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dkeg18.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a47aeaf4-ee70-4710-aedb-be3861f99f8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dl8fob.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dl8fob.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73a5014b-2603-44c4-a176-73093b57da13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dlmtvdb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dlmtvdb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e48befd2-9994-48e1-97e8-96a70cb86b18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dn-produkt527926.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dn-produkt527926.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d21f086-b110-4a03-8f88-3ac0f80a6189",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dn-produkt739255.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dn-produkt739255.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b5248c7-76dc-453d-95a9-09b93ec1bdf5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dn-produkt746829.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dn-produkt746829.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65a8abd0-35ec-4ee8-af1c-1020ac4df69d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dn-produkt836392.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dn-produkt836392.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9794719f-b828-4c1e-ba93-16a7c75caaad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dn-produkt936842.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dn-produkt936842.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a46e27f-5741-42e6-ae45-4cec084ff0c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dn0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dn0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a4752b6-1032-4dcd-ad9b-9f770183130c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dnsfinalsplaylist15.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dnsfinalsplaylist15.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c68d177d-1777-4838-975d-5f474192118b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: do7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'do7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5718bf5-0cee-4588-bf1e-6f68b643874f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dodamtobahaasiti.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dodamtobahaasiti.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9b7f2b1-7d20-4d5c-8fbb-7a5bdc1aebc3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dodelbijavibeza.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dodelbijavibeza.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c278708e-761e-4e62-bcdc-cb87b39e3c1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dogilkahebeaozexa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dogilkahebeaozexa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74e3c985-92d6-4dd3-8bd9-7d4bd87a7324",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dolasbra.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dolasbra.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57c76e79-9e92-45d7-a046-e709704f639d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dom-drakon-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dom-drakon-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86da5d8e-2259-41d9-89b1-b35e2cf9bb06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dom-drakona-3sezon-3epizod.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dom-drakona-3sezon-3epizod.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--524937f4-1348-44fd-8e58-a6a9966abed0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dom-drakona-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dom-drakona-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e5aa23b-8c47-4c9e-9d6d-c6a3c408f3b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dom-drakona-3sezon-3seriya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dom-drakona-3sezon-3seriya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--645ccff8-2280-4ec7-93a7-de0ea0d85a19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dom-drakona-seriya.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dom-drakona-seriya.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5b08689-df5a-431a-8bdd-d4cbc7e32fe4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dom-drakony-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dom-drakony-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27a8cf22-a01b-4c56-b4c3-a89c4fd1218d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: domappeiqemavo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'domappeiqemavo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--371ed749-673f-43a7-9a32-4f353e504cbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: domdragon-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'domdragon-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bbd8601b-fc20-49ca-a042-77241713970f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: domosbozaiemoha.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'domosbozaiemoha.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--060d9961-beb5-4be6-92b1-aa13621c924b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: donmota.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'donmota.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec2f9d05-a8b5-4e77-8538-ef10c5c0d392",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: donpena.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'donpena.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--674f00db-d056-4e9d-b958-fe2cc35540aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dorot.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dorot.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d8eae24-d1ee-411a-b254-befd87763d01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dorzen.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dorzen.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a254018-deba-43ca-afb3-af41533724c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dota-2.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dota-2.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a677517-fa13-4a1c-ae50-2d4835aa4fe8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dota-2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dota-2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--713f8e8f-b057-4db7-8587-42482cfb73a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dotmax99zone.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dotmax99zone.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--021ad55a-08f3-4358-a05c-41da4452c61c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dovetgihaaazihi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dovetgihaaazihi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52613e68-22df-4ec4-989c-b111eb80d9cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: doyujez.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'doyujez.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--770b43f1-54fe-49a4-bfe2-5c77616588e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dpcityai.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dpcityai.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06905120-8ddf-4908-a957-9a4e9bd98331",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dplqvjo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dplqvjo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb35fce0-c8a7-4388-a1b0-ba6dee86edde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dpnv-defender.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dpnv-defender.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7704c4c-4d65-4c17-8a9f-3c166ea92376",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dpt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dpt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f5d2cd8-a78f-4862-a84e-fa63696ef1d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dragon-dom-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dragon-dom-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4142b82f-557d-46b8-8909-b3f71dbff514",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dragon-house-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dragon-house-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93c21f9f-6004-49a5-8e08-7c1b2de9400b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dragon-mmoney.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dragon-mmoney.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f322330-9e83-4e58-90e7-f1f008dbc497",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dragon-mmoney.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dragon-mmoney.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7006757f-f83e-461e-af5c-ab974073ca44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dragon-mmoney.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dragon-mmoney.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a0fdc3b-5a30-4414-8846-e6442a5f9474",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drakon-dom-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drakon-dom-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0791b1e1-f7c7-400e-8340-fe49d43ae573",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drakona-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drakona-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--716b172e-8b8b-4fd5-8813-f0f19c6400f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drakona-dom-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drakona-dom-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f3b4ec6-c167-413c-98a2-9cf174bf3f8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drakony-dom-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drakony-dom-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58b61193-821d-49a2-9c64-48940afc8bbc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dramacoolu.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dramacoolu.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--719d62e4-d835-43b1-9104-0445c72e3afc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: draun.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'draun.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38bf5c54-423c-46d1-98a2-1ea35b1dd197",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dreamship.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dreamship.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--373c30fa-d7b6-406b-8080-faa897a00412",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drenzo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drenzo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d221590-782b-47bd-afaf-8fbd18cc0930",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drevan.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drevan.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5883b3ec-a23f-4ce6-a3a0-6822e13fe8dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: driftmesh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'driftmesh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2195aae1-8141-4412-b4fb-bc87ec03327d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: driftwavelabs.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'driftwavelabs.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b99a5426-db5d-4f02-9596-a8708aee4131",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drkahkesh.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drkahkesh.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51627a70-b279-4ccd-add3-41fa71e9b881",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dropai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dropai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--257c3f10-25d9-40fa-81e3-1b4a672542b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drosth.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drosth.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6f34ad3-9a84-41bf-8944-f27e23effa32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drovelabs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drovelabs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec5b42b3-046e-4162-9c3d-7a23b6c857b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: drtom.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'drtom.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04a3a8b1-8df1-47f4-8ae2-4eab58dc8aa0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ds2wntouch.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ds2wntouch.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d9526d6-4ae9-4184-a498-0a18063f6f4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dscrloan.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dscrloan.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5626c44-0d13-48f3-85b6-76d1bd59f40e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dscrloan.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dscrloan.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97fdf475-9ba8-41ef-a73f-56f315d8b6ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dscrloan.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dscrloan.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1c923c0-d8fb-45cf-a0bb-4be60907711b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dscrloan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dscrloan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50d1eb0b-275d-44d7-9295-211fa2b1d149",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dskfzxs.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dskfzxs.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b5610d0-a1be-446f-ab35-911ce6bc0c84",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dt7ajho.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dt7ajho.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ffbef71-e809-44c7-aa63-e86ce81b50eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dtwb168.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dtwb168.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--998acd05-ae56-4a80-a5e4-ee341ffde14a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: du2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'du2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d0d4e93-abae-4108-8dbd-b0c9398da504",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: du4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'du4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fe98047-c142-449c-b982-6bd7f475f0ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dudspin2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dudspin2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6163cc14-5062-4933-9a75-6e24db919d3f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dufuhaw.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dufuhaw.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f67f79d-9320-4f1e-acc8-31a4eef95ddc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dulcelatido.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dulcelatido.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a7fe9c8-074f-48ab-9f9f-600fa87fef6b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dungopa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dungopa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc13845f-37ac-4400-8cf3-5929033c18ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dunloop.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dunloop.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d620e1c-6102-4db4-904d-2ee5916b16fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dupexxaiqixafe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dupexxaiqixafe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5581a7c8-c458-4015-88c2-c580016ef544",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: durarkotoetoro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'durarkotoetoro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2987b188-1f4c-4e50-ac6b-fa2883b1d3c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: durnexa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'durnexa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e8397f5-b098-4e0f-9f27-d6e44e1d5c3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dustourrenewer.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dustourrenewer.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c646f5f8-09c1-43e4-b1fd-87566cbee26e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dutchtv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dutchtv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0317257d-3c15-4719-a80b-2334d8c22061",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: duxawux.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'duxawux.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dea59e20-a70e-4c15-b512-006ff3e00a65",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dvl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dvl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3ee707a-5f55-43c3-a85d-7709e593aa9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dxbfsgpbb9.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dxbfsgpbb9.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc66a367-af19-461a-b7dd-dc61052d3b21",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dy-jeitopg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dy-jeitopg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bbef857-c1df-468b-ab60-40c18cf0e098",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dy0qm9t.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dy0qm9t.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3944236f-f45a-47a3-a931-67e55ae152b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dyingsuggestionmc79.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dyingsuggestionmc79.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e306555b-f987-4869-b682-fbebde9d9e13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dynamiccoursetrack.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dynamiccoursetrack.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4a198f5-21a8-4b28-8475-4fc02ccf05d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dynamicgo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dynamicgo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--704f823c-8122-4027-8326-ed13bc3a3467",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dynamicsoulmentor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dynamicsoulmentor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--875fee97-0f97-47fe-9528-f6977187e223",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dynaquo.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dynaquo.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01a2daa0-71fc-4ec5-a0e3-541ec1980eb9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: dyp.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'dyp.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb170720-d705-40be-94aa-204b928ba770",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e0u3o4l1.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e0u3o4l1.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee7d8a41-37ea-47a5-a34f-d3404c9320bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e3b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e3b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f81c88a6-b39c-4129-9e06-fb6d38ab27aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e3d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e3d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b54d6a35-a006-4def-b02a-46b97b558ea1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e3j.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e3j.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd5012d2-bb73-4772-9678-cc9148fb9f29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e5v7u1.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e5v7u1.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e3dcb7e-65f5-46f8-9644-388e274b3cc9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e8ctw9b5pszi5y6.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e8ctw9b5pszi5y6.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53615a6d-10a7-4238-bdbb-d6f38cc7d61f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e8f0h74.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e8f0h74.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4bb3051-31c6-4880-99d1-2e8baf81c0e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e8hqekrp5ibn6nw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e8hqekrp5ibn6nw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5764b8e8-f1b4-4b3d-ab90-8bf55e10f23b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e932z.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e932z.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec3a029b-5304-488c-bf40-2ea296a8dafb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: e9r.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'e9r.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3a84697-0eca-403b-a57c-b1329c326dbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eaicloud.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eaicloud.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ca2eb69-b201-427c-a473-af4aaa056fe1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easybwnpe.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easybwnpe.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4af1fec-c2c6-4914-ad30-67447ff5fcfb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easybwnpehq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easybwnpehq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--612a9c06-6ccf-448a-a1ab-1764529a4982",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easybwnpelc.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easybwnpelc.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4db7561-3a67-4c89-a126-b84663f664ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easyelcanset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easyelcanset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71216558-bcd6-4d42-ab17-6a1750dd487a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easyleadbbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easyleadbbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--733d645b-f019-402e-b071-30e4b95335b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easyleadbly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easyleadbly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09cc3551-42e3-467c-b905-463b8e7e0db6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easynflowify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easynflowify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97710a17-7a04-4f7b-8a47-c175cf7d5a0e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easynflowway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easynflowway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--afcbac00-92e2-4f2a-99f6-b4342350b85b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easyparkdk.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easyparkdk.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1876bfbc-5a51-427a-bfaa-52ea41cbaf12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easyrowthify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easyrowthify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49309e5c-6f27-466c-98f4-0d595596a7a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: easyviralsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'easyviralsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f248d44-6946-4559-bbf0-283e12c17e7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eauvel.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eauvel.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bfadfc8c-46f4-4bbb-9405-c53655c31551",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebacessoriabr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebacessoriabr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48b9e057-f275-48c9-b44c-4cd47c30df9c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebmzklx.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebmzklx.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8123e237-f87a-410d-9d0d-dfad17e70bea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebprp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebprp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bbd0447c-f638-4a79-bbc5-35615f789567",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebrictycleric.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebrictycleric.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52242263-8de6-45e7-abb4-331caf73e86b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebtvcamera.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebtvcamera.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a4ffded-e995-446f-833b-f8c6b8a0f312",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebtvcenter.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebtvcenter.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9bfb8af-a27f-4264-b4a2-86a968d9e10c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ebtvmovie29.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ebtvmovie29.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2a58188-0869-4f12-9c7a-6857b4da1ad7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ec888.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ec888.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3aa5f7f-6913-456e-932d-d119e5140938",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eclatechnology.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eclatechnology.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4766c34-1da5-430e-95aa-d22e63473307",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: econclaritycourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'econclaritycourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--417225d0-602b-4715-9600-ad5deea8915a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: econmindspirit.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'econmindspirit.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c05c6687-9209-4097-b303-e8a34738e9f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ed184.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ed184.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--516376a1-7be3-4337-a33b-af63e8b80408",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: editorbet-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'editorbet-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c18a0a7-aa6b-4889-b632-8e5023212322",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: edk0m.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'edk0m.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fab41958-6c6d-4ccd-99ae-0bc8366776c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: edkap.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'edkap.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a33e6175-cf68-49fb-afce-45e06f6af9a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: edsjestar.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'edsjestar.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c413325f-7744-4e21-b086-f00590cf20df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: educationrobotsru489.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'educationrobotsru489.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fdcebf8-8ec6-4f29-b384-cf1d222bc2db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: edustar.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'edustar.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06f42f6c-a286-4159-bbd4-2c19e62c305c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eedss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eedss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3326316-bdc4-4632-a987-6865724e1989",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eeegox.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eeegox.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea600ad5-5cae-4b6c-bf96-6cca468f032f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eeummedicube-sds.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eeummedicube-sds.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf9173af-ebfe-413b-9886-5c43da552a2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eeusoi9sk6fg29s.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eeusoi9sk6fg29s.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12b965e5-ebac-4e78-bd4f-36d8fd5191e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: efesbetguncellgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'efesbetguncellgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a546f69a-f308-4cf8-8c94-750739f9d1b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: efficiencypod.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'efficiencypod.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9da31a92-90d0-42b0-8060-6a7900916176",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: efjs2gr14z7usc7.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'efjs2gr14z7usc7.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d204be4-2c58-4966-8983-d2c343d0636f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: egq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'egq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3f11ee0-a532-4256-bdd3-dbbd0f083e60",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ei3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ei3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--573076e8-3933-4956-84bc-df5c7b0fc6c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ei7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ei7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--10aad5f1-fe3e-486d-ae08-c519a5d0f91e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ej9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ej9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--316b1510-911f-4d8c-9160-72c65b7a347b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ejvss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ejvss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--702da255-31a8-4892-810c-57eeae5eedcb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ekmqp02.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ekmqp02.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fa52272-d293-4ea8-9624-21d5ccf58261",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elcancore.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elcancore.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99670e60-a5be-49ba-bc9e-d94a4a8f2ee5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elcanonline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elcanonline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d28848e7-500c-4492-8cc7-a6c5dc9adbf5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elcanview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elcanview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--face4256-a23f-48ea-97ad-5fa2c379f344",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elcanworld.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elcanworld.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58ff901a-dfe4-4dba-8c69-e15e5083d416",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elderhealthpath.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elderhealthpath.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd6527ef-7a8c-4d6a-9d0c-25af56b6be0e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: electrofactorycloud.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'electrofactorycloud.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d467fb28-e06d-4184-914b-74945b5620b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elevatedspiritguidance.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elevatedspiritguidance.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec630758-ec4d-4582-ad35-3cadd91ba8da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elevatedspiritmentor.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elevatedspiritmentor.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc2370de-7926-4e27-87b7-013e73fa53c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eliozsk4jn21ro7.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eliozsk4jn21ro7.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58e4fac9-f9aa-41b5-b6b1-1aee29f31138",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elitbahis-simdi-tikla.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elitbahis-simdi-tikla.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0f52ccb-4dbb-4850-9c3a-1cf9b853f8c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elitebookcurator.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elitebookcurator.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dcfcc062-082e-4438-a3e2-b3bfbfc34910",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elitebookgurus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elitebookgurus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b643fb33-dcf2-4643-8a4c-7e931cca2df8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eliteflatsselect.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eliteflatsselect.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00d478f5-423d-40d7-9f00-f33ab7c047ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elitetalentpathway-dgi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elitetalentpathway-dgi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ff9f129-d725-4f32-a876-0eef5de245dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elitetomes.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elitetomes.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfcd2883-d886-420b-b384-5ccdac12fb9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ellvites.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ellvites.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d833de49-d396-466e-8675-d79b43ce7408",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elmac.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elmac.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8f66c67-ab25-49b4-8678-b430ea8de665",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elmwoodgarden.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elmwoodgarden.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d33bd88-bd6f-4e7a-99ad-d7e03ff1736b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: elvarnexai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'elvarnexai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1c1f621-81e9-4ca8-8cf8-1c7fb3c53d9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emailux.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emailux.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b7435eb-ebee-4d16-b859-690cbd2acb3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emaraldbraids8394.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emaraldbraids8394.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d946d44c-332f-479e-9211-66a6deb92622",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: embaubaiss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'embaubaiss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bd5f436-bba2-4dcc-a472-a819905d1402",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emiliasiekiera.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emiliasiekiera.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5034eae-ec5e-461b-b753-60de15f1b858",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emilpiotrowski.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emilpiotrowski.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe8d4868-41a6-47ef-bc8e-3f96c5491417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emkal.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emkal.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69b9ff7c-90ee-4dea-94da-ef59e6ef2814",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emkal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emkal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1cb8affb-1c13-4b92-acbf-e81c64bcaba6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emosi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emosi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--022f6559-9285-47b9-88f7-52562e4f2db2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: emosi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'emosi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e638499-b204-4ecd-b813-58178b8cca3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: employeelecturelegendaunt.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'employeelecturelegendaunt.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f33c0d3c-df38-4956-a610-1c8ba25c3b8c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: empowermentspiritguide.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'empowermentspiritguide.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f89ed529-cca4-4bb7-89ad-7418e58e7f96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: en-bet-adresi2.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'en-bet-adresi2.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8b5c140-ea6c-4862-b91e-e808cc19237c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enable-boost-winonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enable-boost-winonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5b336aa-7e3b-4bae-a777-d80b8734ad0c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enable-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enable-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--430de9ba-4ada-46dd-8b2b-0e36cc925e8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enable-boostwindfall-kz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enable-boostwindfall-kz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9710d493-2d01-459a-9257-ac5ccb06380e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enable-enableboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enable-enableboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1aac6ff9-3b72-41a6-9c2e-4d6e802d1dbc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enable-kz-boostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enable-kz-boostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a1fe49d-c7a7-4005-a9fc-80c3891f0e90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enable-kzboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enable-kzboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88c28144-89fb-429b-8827-9a59e5654155",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enbetguncellgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enbetguncellgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56128caa-ca74-41ca-9f2d-9b7489022841",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: encompasscourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'encompasscourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34bc68f0-7601-4449-b3a0-924710d261cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: energeticcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'energeticcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1db1393-42cf-43d8-9c21-fbf00ae2510a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: energy-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'energy-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4b748b3-d10e-479d-aeec-f240c3469aff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: energy-participateboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'energy-participateboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cb2d8506-1f4d-4520-b550-2afcbb1fb4b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: energyrecruithub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'energyrecruithub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b53a8d3-14fb-4d25-bc92-2b9fce9245ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enhanced-accessboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enhanced-accessboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efaa75d5-b8a7-40f5-b9c6-56780d4f8267",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enhanced-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enhanced-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ebb6f6e-e25d-4210-b6e9-46822bc19325",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enjoybet-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enjoybet-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d03b2c1b-ed26-472b-bb81-05807055ebef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enjoybets.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enjoybets.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4eb2d049-cc9a-4ee6-9061-c380f549e4b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enlightenedexecs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enlightenedexecs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39ba006c-5ba7-4488-91e9-fbb71f2d4dca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enlineabcp-credito.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enlineabcp-credito.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50039d3d-4736-450a-88b1-4634bed0bac5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enmznwqa.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enmznwqa.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a39fe409-a23c-4d4a-973f-58d0356864c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enterer.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enterer.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--147b39de-7663-4f38-a42b-59bb02f10f62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enterprisesys.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enterprisesys.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98db0972-d453-41b4-a184-1bd73fb9337e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: enthi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'enthi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40541752-9ae9-4b50-bc9a-de79f2a2714e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: entreplegalsvc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'entreplegalsvc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eadbac62-a36d-4d05-bdf8-b2423f2a8771",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: envr6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'envr6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--218a023d-19c4-4fc2-bf35-ed705f44d8a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eoferta87490.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eoferta87490.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cfdad2c-ea45-4a0e-9425-68f44f6a3f26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eofet99390.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eofet99390.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f15fca53-8fe7-4055-8bb2-c48912a57212",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eoqn6kr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eoqn6kr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce35ffc3-9324-4630-a335-a13e2731fdf1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ep-roor.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ep-roor.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9cc2d29d-c0c9-477f-a11a-de6c5af3a980",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epayco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epayco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cacc95b0-daa0-4d35-9924-a3b4cf00e6a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicanhubly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicanhubly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4e2e09c-268a-4f19-b8e0-9ca9c963e820",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicanlabhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicanlabhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0253138-6007-4d0d-8d1b-780e5365ba4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicanlabhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicanlabhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08298122-bb46-4eb0-9d94-4e2319a9edce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicanlabify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicanlabify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8282ef8-f258-4c6d-bd75-f235b7078514",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicanlabway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicanlabway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--810af89b-c8a7-4ffd-bfde-c4a999fdadf7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicboostset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicboostset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5ecfb41-3d63-4b4f-a3e9-38429863206a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicbwnpebox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicbwnpebox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--754c9eff-f92c-4f95-89e5-ee63da2c21ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicdrols.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicdrols.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8a9aecb-6021-4a9a-b58b-2b3c748a984e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicelcanbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicelcanbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95844da7-b10d-4304-8145-1780a9930417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicewhubsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicewhubsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea953b8d-57ca-4ff0-9d2b-837e5005d74b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicexectraining.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicexectraining.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b95c0f44-ef13-4140-a8f4-ad145c17ee4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicfunneai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicfunneai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6e1a8e0-6d5c-48a0-ba59-191bfb0cc0bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicfunneset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicfunneset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db79b4d4-0c30-457e-9fd5-76e339916e13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicfunneweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicfunneweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de75a068-e813-45e8-99cc-7744bff86168",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epickwnplhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epickwnplhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f1c2b91-1969-4409-91a2-e8d4432d6136",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicnflowbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicnflowbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20ef028c-d678-4a65-b8bf-a9599dfbff98",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicolvan.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicolvan.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9e2406c-1475-4ec2-b03f-cd119b670e37",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicrowthsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicrowthsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b928939d-d213-4b21-b63d-004bf2908dc5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicscalesky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicscalesky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b80ec1c5-d1d9-48c2-8ab3-13e933142286",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicsmarthq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicsmarthq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed8ff588-b06e-4028-ae05-4e81f7688fe0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicstars2825.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicstars2825.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21f9ea79-2928-46e3-bd8d-ee38f8373542",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicstars331.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicstars331.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45779765-f667-4f8f-953b-1b8284b11366",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epicviralhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epicviralhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79aae70b-ad13-4f77-9cc8-c3517ec75663",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eprlxvn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eprlxvn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0df9f9e-07eb-462c-9b31-ed1501110bae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: epxwtlftqegoh8u.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'epxwtlftqegoh8u.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--961d13f1-7cb2-45a0-b4cf-de43081e3968",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eq0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eq0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e97b4ec1-7b96-4846-b092-3ba188c5cd71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eraplay88mgc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eraplay88mgc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e44dded-d4a1-4cc6-8604-61ca363c7fb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: erard.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'erard.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--791883b1-e3e4-4368-82b3-5706264d009b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: erhalten-1043015.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'erhalten-1043015.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88661f9d-7663-459f-9487-a36d1e783a94",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: erhhalten-data0983.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'erhhalten-data0983.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad4b3968-50c3-4e9f-ae6e-f9849ae89965",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ery510g.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ery510g.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd4272d1-d2d0-4fed-9588-f91f8544656d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: es653.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'es653.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2a45bb6-1187-4145-a945-69070ca78462",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: esevents.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'esevents.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db7e2241-ed71-4dca-bee3-32d1bddd9405",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: esisuby.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'esisuby.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3c7fed8-4004-4605-9b64-07c604908810",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: esmediallc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'esmediallc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--da622065-3b79-4b7d-b1c6-f027e57d1f01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: espate.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'espate.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93a35267-a62b-41e4-9880-d67c9bd8bdaf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: espuma.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'espuma.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33beb970-9877-404b-beef-cc0260ade2e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: essencevideosolutions.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'essencevideosolutions.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc53c5fe-b200-4b0b-bc16-f74b8758b09f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: essly.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'essly.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfe22d28-95a3-44aa-9b5a-0d5ae4c4e5d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: estatelawguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'estatelawguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fcaa7927-b4b5-4bea-89b3-50fad226314f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: estrepethralls.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'estrepethralls.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ebc89e6-3a0f-4546-b781-52ddfea3be6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: etenferes.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'etenferes.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33219152-a55a-4100-a263-f9325bb90254",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: etevc.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'etevc.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56a31f69-c52f-412d-9228-5bf0b79bfcf5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eth-hyperfoundation.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eth-hyperfoundation.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23463aa4-f916-4aea-a75f-e12087a32e47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: etherealguidancepro.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'etherealguidancepro.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebef9628-cf94-4fb0-81b2-ae2415d30e62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: etherealpeak.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'etherealpeak.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f604b4df-a493-4003-b487-c96329a2c623",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: etoileroyale.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'etoileroyale.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c35a28c1-6ac4-4b83-9ea1-57956cce1d2d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: etqxdc9.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'etqxdc9.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--94e8e89d-db27-4de2-923c-22c7e843436c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eunagzc72ua8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eunagzc72ua8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0806009-6fd0-423d-9d55-c83f23bf23a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eurovoice.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eurovoice.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c8e7801-de96-4c2e-ba9f-63a781995d91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eutociamonarda.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eutociamonarda.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34ef569c-832b-4ad7-afbe-9f2e74bbafd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evaluatesmartwork.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evaluatesmartwork.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b42582a-7726-4361-81a4-8e621d4d52f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evcog.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evcog.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50241b96-7b4f-4758-8355-0c738731a46b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: everopen.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'everopen.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--408e2a04-f892-43e0-b10f-5c971e189068",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evostotoh0kii71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evostotoh0kii71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b16944b3-1595-45f6-a20d-0d87b0b96c29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evostotoh0kii72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evostotoh0kii72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9725494b-909e-4540-abf4-a5197ef92b36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evri-notlce.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evri-notlce.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3eb854a9-655b-4f93-b9a0-4187149259b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evri-notlce.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evri-notlce.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8191e6f-d680-492f-a3a5-b5e3b1502334",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evri-notlce.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evri-notlce.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a17ed7cc-d0fe-4e32-8ca0-93bceebf7615",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evris-notice.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evris-notice.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aae1502b-05c1-4602-9c83-98f2742bf60c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evris-notice.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evris-notice.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c04edd1b-776d-4145-a5a9-93c2c938bad4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evris-notices.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evris-notices.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df6283cf-8cdd-4149-a2a8-bc0c4f133f8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: evris-notices.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'evris-notices.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ac21903-901b-4914-837b-45559891c20d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ewabak.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ewabak.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16171a58-7cc5-433c-b421-0fa94fa7be54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ewadzwigalowska.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ewadzwigalowska.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7d2cb35-1ae0-4d0f-a78b-3fa3c2e99df9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ewhubapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ewhubapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2a6b551-fcdd-489e-84d6-ca9942f1c1a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ewmhyra.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ewmhyra.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d46fa44-94d0-490c-a69e-57c64594013d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ewmtk02.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ewmtk02.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7017dfca-f36b-465b-a434-2e16a2347f65",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ewn.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ewn.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca774227-9fda-486e-bdf9-e7958f003f08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: excelcorretoradgdfgd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'excelcorretoradgdfgd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65a3a820-f26d-48bd-a3f2-b193e412d7f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: excellentvideofocus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'excellentvideofocus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8da5323a-0209-4dc8-844d-8de81a468570",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: exchkwsd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'exchkwsd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f1692e7-dfbc-4cac-8577-d5472ba1d4e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: exclusiv.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'exclusiv.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd2b2c1b-066b-4cf2-a406-2b0492e381be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execadvancecurso.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execadvancecurso.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b658742-442d-4e63-b689-2e98e5ab50db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execalchemylab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execalchemylab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1db8fe41-af63-4093-900e-b43fe059fdd1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execboldmentor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execboldmentor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bfde84c2-d08e-4f5a-a2bb-119809378662",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execchampionpath.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execchampionpath.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18e67212-931b-42e8-82eb-3b0334873f09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execclaritypath.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execclaritypath.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c5a49dc-9622-48c5-af98-0695cf1c79a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execclevercourses.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execclevercourses.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49efd0fb-9138-4884-b9ef-ad7654e88d87",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execcompassskills.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execcompassskills.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46d3a43a-28fc-4cea-b3d1-fe48172679e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: exececonspirit.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'exececonspirit.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11d5823b-8108-426c-ad6c-6c40494b9bae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execessencelearn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execessencelearn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ff8e48e-9eef-46bc-8a52-c110376b6d41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execexceedcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execexceedcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfe87b02-6363-4a95-a30b-ffdb337e6ed7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execexcelsmart.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execexcelsmart.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31abc6ce-d283-4e0c-9f9e-452a19629c90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execinnovativelearn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execinnovativelearn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e102c6e-48a9-4691-8c41-a2c7e473fbfe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execleadcoach.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execleadcoach.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--963d1553-ca36-443c-8aad-60a6451c59ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execlearningleague.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execlearningleague.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae25e0f3-b3fa-41cc-b856-2aba731f8a5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execlegionlearn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execlegionlearn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66a9ea59-4159-400c-a6fd-eb9759f70669",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execnewhorizons.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execnewhorizons.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c812e0dc-2ee7-4c08-bf3b-ba73aec7f937",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execpathpros.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execpathpros.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f63bbb34-bba4-4965-8c9f-77ad7bf8047e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execprimegoals.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execprimegoals.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22ed2bf5-aacb-4a7a-bd2b-df466549ea91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execrefinedskills.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execrefinedskills.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76b7cf7d-5790-410c-a376-b0cc7f844d79",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execsculptorskills.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execsculptorskills.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0aa8b78-07ba-48c8-a872-7d93ff3faf27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execshieldpath.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execshieldpath.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7844d28-1f2e-4bdc-950d-a7ff72c470d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execskillsmasterplan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execskillsmasterplan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fad4397-0468-40be-8e3a-7a7a316ef16a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execsparklab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execsparklab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b862e39-5699-4421-b965-982911af5c92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execstrategistlab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execstrategistlab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--544ebe74-a68f-4e22-aab3-735b3dfd034c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execsummitguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execsummitguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89ed7ca9-a980-41ca-91c2-fa8322bbaeb9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execthriveguide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execthriveguide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b6cdde8-acaa-49e6-9cec-7de873cb5058",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execvirtueclass.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execvirtueclass.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3411b329-4365-4a7e-8d02-180d0d0cfc28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execvirtuosolearn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execvirtuosolearn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14e7692a-e6e2-4e56-86fa-e09fd392b434",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: execvisualizerlab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'execvisualizerlab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbdc241e-4077-4072-8548-758d7e71b978",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: exoh0iq.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'exoh0iq.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b2e9abc-fcc2-4d28-a543-513e129e3a3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: exototo77jhg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'exototo77jhg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a918f9b4-4b42-4dba-a22b-b835977095a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: experiencedpropertylaw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'experiencedpropertylaw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b17be1fd-dc5a-4ef2-b3da-9addf0a3ec1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: expertaiplatforms.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'expertaiplatforms.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03b74e85-125a-4be7-a5b8-d3d0cf1e044d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: expertcoursevalues.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'expertcoursevalues.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--124a29f2-a670-4d56-abea-e80d154936f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: expertvideoadvocates.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'expertvideoadvocates.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4acb0106-eee5-4d3a-b887-21628e1d4ff2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: expertvideomasters.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'expertvideomasters.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5406010-7f73-4a42-9e7a-8505b7beb1d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: extra-adresin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'extra-adresin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c552bb6d-fb24-4796-ab93-f9cd6b2ef381",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: extra-officials.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'extra-officials.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3995ac3f-6a26-41d3-a726-f1edd6761c68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: extravipgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'extravipgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d331fab8-fa98-4764-9407-de5b87232bd7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ey0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ey0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee7bd87b-dcf0-4e04-b054-cb63b9e71eb2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ey136.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ey136.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ca4a103-77b5-41fd-8ca3-39ae267e205c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: eyauca73ck.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'eyauca73ck.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42b19179-a598-46e4-9f1e-4f0d58c03fcd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f1v.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f1v.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--132aadf3-987c-4576-a80e-3eeca81ec1ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f2jlnoh.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f2jlnoh.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d7dbf07-3bc3-42fb-8bc6-6faf0776389b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f5bxsgp4ee.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f5bxsgp4ee.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82015ea7-23cc-4185-a0fd-5ac7e1bd9838",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f5hbzpf3dh65jyw.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f5hbzpf3dh65jyw.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0ce5c4b-8042-4395-b828-c721018d2d0e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f5r.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f5r.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87212a04-489e-42e5-89a8-2a175c0c5d31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f6essgp49s.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f6essgp49s.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba4addbb-be64-4688-b283-3051888d631d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f7p.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f7p.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa14a09e-3284-4ae1-b4b6-b9781aee4413",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f7xa.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f7xa.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe92c223-774b-48fb-8bf3-4fce48536f42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: f819ks4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'f819ks4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6b2e945-3dea-4302-9ecc-65219d309b70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: faawswy.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'faawswy.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4bed5154-ac3b-4247-93b8-2d1d8e9a9200",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: facettebogyismtraik.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'facettebogyismtraik.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ab0e05e-190d-470c-83b8-7bc9ef4c48a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: facicbosoiqadace.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'facicbosoiqadace.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e5c86d4-641b-4e89-ae62-89742f63a561",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fadel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fadel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82673b71-2e68-4055-b01d-4e14d375ae49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fadovhaexahipi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fadovhaexahipi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd899460-5c07-428f-91a5-1a4b41310f49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fafonbiivoifide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fafonbiivoifide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac95bf15-5599-433f-a370-6961c10c875c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fafz-adguard.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fafz-adguard.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08049b84-84ce-45f5-8efb-5a11c6c41ea9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fakipuj.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fakipuj.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73d091cb-a321-458a-9d1b-db63494e6695",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fallinggrillblond65.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fallinggrillblond65.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d28b4a33-437b-4e68-b917-3845a51775db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fallout.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fallout.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3748506a-2c9e-4394-be18-9b483a1bcfb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: famconnects.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'famconnects.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1baa76ed-33b5-4dcf-8e24-46e119c5f5ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fanandfam.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fanandfam.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1ced378-b90d-455a-ab8c-4f3c7e9dd67c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fapaskioikohi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fapaskioikohi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0befb30-9ccc-44f3-99c2-01e50eec7a1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: faptlhm01.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'faptlhm01.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01930bad-109e-4c55-b3ec-349b64aa89be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fasekhebemo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fasekhebemo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--676b4358-398d-475c-9565-b55e2851e302",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fasocgoregeosemido.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fasocgoregeosemido.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef9e0125-3430-456f-a128-d9b9d594a538",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fast-vefis.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fast-vefis.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37c16c8a-e123-450c-bebc-ca7f6c101fba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastanlably.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastanlably.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38b0e03c-f732-4aec-8bcf-fa6a596a6269",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastauditsolve.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastauditsolve.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b514ead6-528f-417a-8a43-1935524193fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastboost.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastboost.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d0291c02-8be4-4f59-87d2-a31afa15704d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastboosthub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastboosthub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--308598c7-8483-46d7-933c-b4c14b9d1e14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastbwnpehq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastbwnpehq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc12d147-571b-43b4-a011-2e1b569d7489",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastbwnpesky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastbwnpesky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b08b9c73-bf34-42b2-bfc7-32094e3409bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastelcanway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastelcanway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98b01d49-a8ec-47b3-bf3f-4cd9564cd337",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastenaewway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastenaewway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b349ff8-148f-4e6e-a8a2-e87828e4a823",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastest-betboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastest-betboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12784657-63d7-416d-b71d-ef069846d4dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastest-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastest-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8957cf0b-8112-4d29-95b6-c1d704d3fb03",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastetricbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastetricbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c8f6ff5-d24c-4734-b4f1-89219a80caba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastetricly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastetricly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--127be4df-9d32-4ff2-a800-1e83ea4581a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastinglefties.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastinglefties.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f14506d4-9d46-4ece-b1f9-f79327ac1224",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastkwnplapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastkwnplapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--205577c7-e055-410c-8fc5-e38cdc4f0cc7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastkwnplbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastkwnplbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbc359a3-1819-402d-ad58-b3a79d927792",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastkwnplhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastkwnplhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d731b1f-12c3-4b58-8627-2f3cf47f09a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastleadbweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastleadbweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8118c78-9d4a-4224-9a44-6dd2a8b7892f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastleadkbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastleadkbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11130f1d-c086-42ea-bbe6-053372d01941",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastleadkhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastleadkhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d799d7f9-87e6-4c29-9503-81d11e5f7875",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastnflowbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastnflowbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3efa8fef-194e-469f-a565-dc76403764c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastnflowhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastnflowhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5cbaea0d-68e0-4564-ad56-9d8e0687a4a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastnflowify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastnflowify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0d54a8b-785a-4274-b586-76f70167c0fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastnsyncly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastnsyncly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8d95572-2e4b-4939-8845-8bc995c20178",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastnsyncway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastnsyncway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20b7ae87-3e08-43e3-8e02-cb6295a90c8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastsmartbw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastsmartbw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f98ea12c-54c7-4c4a-961a-cd7dc1563602",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastsmartsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastsmartsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e681d35-8a65-4049-8835-bfd312bff9c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastsparkbase-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastsparkbase-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb5b5f4f-7ee9-462a-9f11-82afdefa67ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastspeed.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastspeed.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b53140e5-d9ea-4fd5-a945-6df5fb44a300",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fastwflowai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fastwflowai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26556837-7f8a-422e-8c4c-943b6a520d17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fauske.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fauske.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d2ce1e4-6e1d-42bb-9c15-ec2563c64bb3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: favabcupatesohe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'favabcupatesohe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--caab8363-7100-4e07-984b-3e3f51005c2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: favvemi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'favvemi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f6fe6e6a-d77d-4746-80c8-dbd87bcc2030",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fawelkq1688.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fawelkq1688.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f600d41-284b-4152-862e-e133842263c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fb-home.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fb-home.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3bfbff05-1bfa-4acd-9639-39d71d15bdb1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fb-trader.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fb-trader.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--924336db-4c31-44ac-b52d-e62cd08c6d5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fb-trader24.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fb-trader24.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d1150fb-92fc-40eb-b8fa-fcfd1b851aa9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fb009.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fb009.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ed0b711-dac3-4483-9f1d-bbb8680cf538",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fbgjxskjkd.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fbgjxskjkd.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48156e40-d0c6-470e-a030-24f4029e26e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fbgjxskjkd.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fbgjxskjkd.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3b07080-37cc-4184-ba5e-0154286a74dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fc56sgpb3s.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fc56sgpb3s.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9985a293-43ef-4f8d-928b-39fc1d4ae211",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fcbhgry.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fcbhgry.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c24ff4cd-16bd-42fa-a0d5-36fc6a0d2098",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fcs8sgpc4b.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fcs8sgpc4b.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--263b8b37-bf10-4b20-9def-66fbe2bd271d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fcsj5mx149drh2n.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fcsj5mx149drh2n.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d87b336-7604-43c9-adee-90d3a6e5e931",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: febssgpx75.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'febssgpx75.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ef1c5c4-e67b-47a0-adcc-bb539f0adf1c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fedusib.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fedusib.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--498ccdb4-278c-404c-8558-224cfd6621ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fejagximaviaotoma.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fejagximaviaotoma.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53e3ffc4-b9d3-4a94-b2dd-1f48fdec8daa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fek.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fek.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--864beecf-6f71-4548-8bba-f71224f2125f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: feknilo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'feknilo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31620e59-5749-4ee3-88fe-bdbf390eeb47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: feldsparforge.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'feldsparforge.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6d5a095-cff9-44a3-a804-119e9584f898",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: felekatogo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'felekatogo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e94f17d-627a-4aa9-9620-a1af2113c902",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: femboykisser.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'femboykisser.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--94c21efc-1a36-4bb4-b2ce-a803b1c2339b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fenegtovahelebeda.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fenegtovahelebeda.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5e451e5-0ddb-4396-8488-6a4a6f1bcb64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fenevlexarooatelo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fenevlexarooatelo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bf3431e-8dea-498b-88e2-c9f8ef06fab3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fenixcasino.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fenixcasino.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d340565b-9796-4f20-89d2-4e865b5b9c91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ferev-tickets.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ferev-tickets.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e67cceb-f51b-46b2-a276-186652bf5043",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ferivqorix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ferivqorix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2bd39e81-0614-4eae-aa86-1a6da828fa57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ferklrfmejnfje.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ferklrfmejnfje.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70c131d4-9de6-42f2-8d96-06f93dbe5c9e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: festiveparty.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'festiveparty.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa1726f6-69a7-451c-bcb8-d25be3998cfb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: festwin-dogru17.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'festwin-dogru17.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--534c45c8-8e79-4836-871c-dcac7032c9cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: feticcobibookogo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'feticcobibookogo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7985b34-aaa5-43c4-ba78-404e76c4a90a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fevomfoentadiha.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fevomfoentadiha.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6ced5c9-cb3f-43b4-b692-ee35caef2d5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fewedit.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fewedit.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee43dc1c-0ca4-4ae3-95a8-3294bd96f3dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fgdtransit.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fgdtransit.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7dbdb595-d8e9-49c0-9d0e-f667a181747c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fgelite.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fgelite.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--852f1bfc-b08c-410a-adad-b41326f97627",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fideg.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fideg.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--290fca0b-9543-40ea-9ae4-0b66b3386eca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fiducenza.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fiducenza.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--31cdfc49-67fe-4a0e-a50f-589b5c3d6f30",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fiduciarytrust.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fiduciarytrust.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--141a4686-8528-4c62-868b-9f24dce23552",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fieldway.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fieldway.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--edf167be-9c08-45cf-8528-68d4914cae87",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fifatasalodi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fifatasalodi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7c32ee1-89f1-47c5-98b6-dd8d423d9ec2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fifiumaulnex.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fifiumaulnex.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cce2583-9483-4153-9227-c2b6f4aeb8ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: filiporgan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'filiporgan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4e042df-eb59-4e72-b35c-f6119601ed6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: film-pertutti.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'film-pertutti.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7285441-db63-43e4-95db-c0dd4417edb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: filmcandlesister.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'filmcandlesister.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b53b06a-4349-4ed0-86ae-079f645fa546",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance20-omnis43.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance20-omnis43.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fe7c214-e3b4-43c9-9051-398f82ab5247",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-cupiditate63.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-cupiditate63.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f8452f1-1b24-4632-aa6a-32982ff6dbf7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-doloribus32.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-doloribus32.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67b0ea2b-c280-4f9d-a35f-729ccef1ea3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-modi54.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-modi54.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf61f2c6-ae06-4fe4-b3d3-8cd101dc75f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-nisi27.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-nisi27.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97be9894-c935-4e8e-aabf-cccd0915a1f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-qui64.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-qui64.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d84870f0-f6e1-4268-9773-d03931de5e57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-repudiandae47.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-repudiandae47.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18c5291b-6164-45cb-8964-f702b0e57761",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance21-sunt46.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance21-sunt46.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c10afc22-dac1-4764-a211-1f158ed81c01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-atque15.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-atque15.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab7356fb-4b71-42c5-b730-c78da5cbeb31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-beatae23.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-beatae23.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ade00dcc-0637-49bb-8fda-29dbcbbea217",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-cum26.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-cum26.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c138932-a9d9-487f-8655-f8aa204cdc3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-cupiditate53.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-cupiditate53.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fda201d9-ed13-4156-815d-4f3eb2af2c3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-ea10.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-ea10.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66dde6f4-5e72-4323-a441-3101e990883c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-eos4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-eos4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cc22ef6-f4f0-4688-b7ca-3b239ce301fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-rerum52.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-rerum52.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--461097be-9aa1-4c20-8cda-ac6289145a3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-ut83.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-ut83.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b2f1ee2-23d1-46bc-a483-8a522280b49a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance22-vel96.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance22-vel96.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83df8fc5-562e-4038-a8ae-edd456a5b1db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance23-atque46.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance23-atque46.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--582250b9-396b-4463-9674-6dafac4bab14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance23-aut70.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance23-aut70.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e49cc1e8-6076-4c99-a381-39fd444398f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance23-voluptas94.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance23-voluptas94.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9be158f0-392d-4f22-985d-f0aa2121c15d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance25-ea46.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance25-ea46.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f347cdb8-5161-479b-ab76-4b09750cb131",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance25-eius82.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance25-eius82.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6cbee7ab-c456-46db-8c42-f6945e9c3a1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance25-reiciendis41.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance25-reiciendis41.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f836fdec-6424-483c-aeaa-fb8532ae5de6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance25-ut38.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance25-ut38.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ad6fd83-3241-4a36-9d9a-6b64604e507a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance26-alias95.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance26-alias95.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--899a4c6d-796e-4638-8536-b43957b5338b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance26-facere62.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance26-facere62.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5d52aee-2e85-40bb-8836-bd536ef7aed3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance26-qui80.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance26-qui80.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cf1d6c7-a462-441c-9cf7-04d035da38e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance26-veritatis44.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance26-veritatis44.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38174ea9-f160-40fa-8001-248876de4fd1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance27-aliquam64.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance27-aliquam64.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f63a78e-deb0-4730-8b12-dea2482471b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance27-blanditiis20.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance27-blanditiis20.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e04f227d-7792-4d98-a481-5ef49f059d4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance27-distinctio73.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance27-distinctio73.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0cab2196-34ac-453a-ad5a-2af9a02006dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance27-esse82.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance27-esse82.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--201693c3-61f5-4647-9c6e-44d7eeb742c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance27-excepturi52.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance27-excepturi52.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f83dc30-2cf6-4a08-9d20-694c360b0a5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance27-nemo59.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance27-nemo59.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4564be5c-405e-4de3-b813-ae091045f471",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance28-doloribus51.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance28-doloribus51.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--572dfaa1-aca1-4957-acc4-b24cf160a6ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance28-in88.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance28-in88.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d227d47-9f28-46cd-91a3-fecd6d297a86",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance28-non86.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance28-non86.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8046f84b-62b6-44cf-9b34-357458c5ed2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance28-provident3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance28-provident3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80f7ddc4-05da-4743-aad9-575d94fd4296",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance29-amet25.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance29-amet25.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--101bdb9f-cc9b-4756-915f-47fdd6ed523c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance29-dolor73.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance29-dolor73.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8fbbcc54-b62c-4ea8-963c-6610ff3b07fb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance29-saepe94.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance29-saepe94.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f05d09cf-5ffa-4640-8c52-43b2f373de3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance90-amet39.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance90-amet39.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b7383ad-66d9-409b-aba7-ed38540059b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance90-aperiam71.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance90-aperiam71.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21959813-f2c7-4076-b9c6-30ff393ce9e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance90-explicabo74.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance90-explicabo74.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--261838db-a52b-4d2c-a411-6a0a29661f80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance90-nemo3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance90-nemo3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--136d0733-6e29-4bf9-b0ac-5dcc4d79cf4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance90-nisi60.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance90-nisi60.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9ce5bd3-ba0d-4f88-91be-a0b710db0d06",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance90-quidem85.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance90-quidem85.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f08ac834-4dcf-4785-8076-75e047ed192b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance91-deserunt87.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance91-deserunt87.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8722deb-7ec1-4462-8c13-90b34cd83e80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance91-incidunt2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance91-incidunt2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14090e87-3c9d-4b6c-a593-5f4f47920874",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance91-laboriosam66.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance91-laboriosam66.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c364a46e-e1ae-42a2-967a-b5077179bfc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance91-vel78.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance91-vel78.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06c975d5-29e5-455d-8e1b-4399b0c214e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance92-exercitationem7.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance92-exercitationem7.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f512a74-50ae-4b88-a415-1d489b418b44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance92-nemo52.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance92-nemo52.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71ce9978-c46f-482b-8c5d-fb489cc6ff84",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance92-saepe4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance92-saepe4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c48f9769-6e22-4767-994c-da3662f9e40e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance93-eius80.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance93-eius80.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68dcd72a-fb1f-46af-be60-ee3a494bda4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance93-facere0.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance93-facere0.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bced9520-020c-429c-be68-3ef315e1735c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance93-rerum84.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance93-rerum84.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fa0d733-b886-4943-957e-773a49ea3e4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance93-voluptatem50.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance93-voluptatem50.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3831130-5d25-4c72-b3b3-91bdba549708",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance94-eius43.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance94-eius43.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df4a3886-9ba2-4f23-a6ba-4c880a33b3ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance94-excepturi44.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance94-excepturi44.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9a1f998-e62b-4481-a598-2682b4b12343",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance94-nemo50.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance94-nemo50.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cac0f833-e5f8-40c3-b71c-95ccb63e87f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance94-quo87.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance94-quo87.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c5f13bf-5322-4e6c-9aed-0260ecfbab19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance94-reprehenderit76.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance94-reprehenderit76.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42c0a251-b27e-4242-adc1-0edc4bdd98f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance95-iure71.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance95-iure71.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13afcfaa-13a9-4295-8651-ce7b8d516ccf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance95-provident44.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance95-provident44.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0216e8ce-d07b-493b-a0cb-81f1b2b80e69",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance95-quasi33.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance95-quasi33.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d27ffbc5-39ac-487c-ae11-a89ab1e87e13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance95-velit31.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance95-velit31.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d282fc3-e294-4f67-9734-1297d7c5fe20",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance96-quis9.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance96-quis9.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea7dc174-e083-4e82-acfe-383c39babea3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance97-dignissimos5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance97-dignissimos5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7732830-9bb5-4bb5-a319-243a05bc4e63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance97-eaque58.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance97-eaque58.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e136f23c-1812-4ba6-8c4d-cb4899b408db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance97-nemo84.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance97-nemo84.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0cb459ea-c46f-4611-ad7e-8d2ff5824df2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance97-soluta23.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance97-soluta23.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fb77e9e-9682-4e3e-a46e-d5c455920f4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-fugiat57.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-fugiat57.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2572457c-3440-49a7-9d0d-d0a64e138a83",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-labore44.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-labore44.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b502bc91-f31e-4a31-95f5-b6358abf73c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-neque35.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-neque35.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e67c8bf-0ece-4c7f-9b44-1abc10ba7c7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-optio16.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-optio16.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40f60bb8-6cff-4de9-8855-a66cd910180f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-saepe35.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-saepe35.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad080f43-842a-4c35-9421-153b8396d159",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-tempora96.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-tempora96.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04757daf-6872-48ee-8731-8eb0670d5bb0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-vel45.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-vel45.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0ababc98-6b4e-4db5-855d-44db13787e39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance98-voluptatibus79.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance98-voluptatibus79.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29fc8020-ac2a-464b-b0c5-621412bbb68d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance99-ab71.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance99-ab71.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--852dbb7e-f1d1-45f2-9a14-1713785e9dc1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance99-consequatur75.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance99-consequatur75.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e7808a7-67a0-4741-991a-9c09ac3f57a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance99-iste10.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance99-iste10.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d4da4c9d-5b17-4bc6-a8d4-4191686e151c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finance99-odit1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finance99-odit1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5baac029-c7a7-4128-bd44-b62f478620fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: financialforms.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'financialforms.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--603ff824-4936-473b-a852-5e90b2ab34de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finanzassdwq.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finanzassdwq.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ace8636c-dacc-4a4c-8f11-de5699568706",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fineisa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fineisa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fede7270-a6a9-409a-ab80-6b50092ecf7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finex7.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finex7.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87cd50e4-3453-4314-a69d-590cf1853ef1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finovesta-croatia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finovesta-croatia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b70fe65-caaf-48e9-9e3e-f3808bf01e78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finplay.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finplay.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bae7fd85-0bb2-4844-a713-15c55651309e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finstep.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finstep.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6060a61b-c453-49f4-8f08-c88916d2c2ef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: finstep.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'finstep.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e4e0b60-9d62-49e9-bfd7-216ab0633bf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fiorbitum-6-belunarum-comatrixa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fiorbitum-6-belunarum-comatrixa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--819ebd92-83fa-4045-b451-b6f11a6d9a61",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: firthly.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'firthly.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24009c54-da23-43a9-b46a-10e7847992ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fishclub.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fishclub.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6873e6c8-f2dd-4b78-b6b9-9fbf480c4d0d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fistentech.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fistentech.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a24d75b8-b0ae-49ad-977d-5255782eb815",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fistenteches.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fistenteches.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34c4fcae-42bf-4df6-b46c-c5f510d6a297",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fiverr-payments.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fiverr-payments.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--944768b5-1989-4919-8d57-daf6b89bb28c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fiwtucbo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fiwtucbo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82e7fe9a-e21c-49e4-b0c2-e1a6571e6ec0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fixdoe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fixdoe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ff66dd9-0896-48ec-a5ba-d5e4e37bec12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fixeron.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fixeron.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28b55e04-0910-478c-b0a5-7cda4d5a4433",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fixerons.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fixerons.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--afbf1625-7bf3-41e3-ab32-0003c576492c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fja.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fja.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--679a2663-3cda-48fc-aecc-dcd7d35b8bc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fjkdh.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fjkdh.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c8ff7bb-ed7a-43d0-b3e6-166be7c78a4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fkgwk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fkgwk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--930600fe-3993-420f-a17b-4dd12ac6ccfc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fkmzxhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fkmzxhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03f21cee-9d2d-4aa7-92f7-9050ca7880cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: flagyaoqi.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'flagyaoqi.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--315f8f79-815a-4d2b-85db-8c0df62d0b5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: flaht.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'flaht.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a9ea91e8-1b6f-43a2-9979-ae629685abb6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: flappycasino.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'flappycasino.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce78ba9c-4136-411f-8db7-5c960dbfc8d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fleecehosthughes15.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fleecehosthughes15.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4db92f51-c3c7-4140-b042-4265cbb2fe9b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: flyfi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'flyfi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6743fa23-e324-4c87-9019-27d6d4179716",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fm666.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fm666.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5e86467-e391-40b0-a2df-3968a7b781f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fmhuimje.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fmhuimje.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19049484-80de-4491-9308-56d1196f2057",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fmzplhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fmzplhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2efa4e9c-5d99-487a-be65-e5fb64cbe58c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fn1mp46.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fn1mp46.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8af59ff-8fad-4e0f-a7a7-16ce97398a1e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fndxanvyw.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fndxanvyw.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04e9f758-a57b-428b-8153-8661499e85aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fnrmzco.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fnrmzco.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf075972-6392-4664-8618-f58f70864070",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fobiddezenoivoolalo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fobiddezenoivoolalo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83b1f832-f808-498a-b2ef-b499f69928bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: focepgoloerigi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'focepgoloerigi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--169e0616-d6bf-41d3-b3fe-7abcaefa3e7f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: focobnooraereke.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'focobnooraereke.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eecb1c29-2f41-4b08-b8bc-bc5b955f5d0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: focusedcourseconnect.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'focusedcourseconnect.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff2b3330-3501-41ed-986f-3ff3adb8fee7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: focuspodnexus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'focuspodnexus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68ee0cec-5a1e-4cb9-a846-27365d9a53f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fodezbubuviokego.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fodezbubuviokego.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--375519db-cca1-4554-958d-9c9a2939295d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fofice.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fofice.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40b83fdc-f29f-4169-b856-64cdf2067625",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fogon.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fogon.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5f466ae-8cbe-45f6-a8cd-fc1474dd28fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fokehvixebonoipati.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fokehvixebonoipati.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a3308ec-7907-4347-b7d9-73cac26d43a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: folagefaze.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'folagefaze.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--acc1d654-44c3-4286-b271-9d15dcffc2be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: folifeh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'folifeh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27185acf-0b79-4419-b7d1-183f12cbec73",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fonkase.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fonkase.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0fff19f7-29d7-4ee3-8dde-991a215a9607",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: foodbox.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'foodbox.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d56c066e-0ed4-4785-84c6-6a5755718078",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: foodroo.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'foodroo.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4e3e013-2140-4e9f-8c93-575659e46cdd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: foodster.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'foodster.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6369b39c-9022-4ae7-8982-d90a57111d26",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fook-yuens.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fook-yuens.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4aa7fce-f6ec-4c92-a131-2a6a82a28060",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: forgetactical.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'forgetactical.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7cdff0bd-be3e-47e4-b8cd-402623c69ab6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: formail.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'formail.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ef9923d-aa67-4670-bf0b-f0376b262777",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fornew.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fornew.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d22f08f8-f847-443a-b5e6-e79cca50d0a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fornewe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fornewe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30a25ef5-f657-45ec-ba37-0729999d0f14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fornewer.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fornewer.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--791c8391-c263-4e3f-ae3d-ef165722d72a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fornewers.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fornewers.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d3a88d4-6fb4-4b11-a3ce-9d9c83545b21",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fornewerse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fornewerse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61788219-aa3d-447c-a0a0-49cd6ac95fdd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fornewerser.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fornewerser.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d11bc62-9b34-4010-884d-6ff78ebb7358",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fotoinfrraccion.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fotoinfrraccion.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d463496-e98c-405d-a296-dce1b9bdd6f4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: foundry-leads.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'foundry-leads.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd251146-d10e-492d-b189-c8243cbc8f39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: foundryvideopro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'foundryvideopro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08269b4e-49ef-4a8d-a9e8-4f8bd538df93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: four4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'four4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc3a7f87-a0cb-4c32-966c-457d903306c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fovxzkd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fovxzkd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--10de3357-7b29-4074-8b69-1c523c04122a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: foxybn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'foxybn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85ba8dd0-0e71-4f12-9aa4-e06211e85753",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fozejuj.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fozejuj.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--267124cb-98a0-4dc4-9aa2-4a4f28512c66",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fp4model.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fp4model.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b42cf85c-9cd7-46ea-ab8b-02240a1a6127",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fp4tg5k4u1ai8ez.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fp4tg5k4u1ai8ez.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--348738d5-ad79-405a-9e17-622d642ebde7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fpconsulting.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fpconsulting.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--799fa80f-7332-4684-8dfc-73a39013136f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fqzwhyn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fqzwhyn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f42a9e91-b758-4f27-8e24-94b39d3974b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fr1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fr1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bca7c6c6-0f06-42d4-acd7-b3e135a8843d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freddienoisedpeaiism.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freddienoisedpeaiism.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b640da8-dacf-4fe1-a2e6-8147e31a6163",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freemoney.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freemoney.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3311f2f1-7608-42f2-b557-2c09feaafff5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freetool.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freetool.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ea9ab9a-6933-45c2-a674-aab70a9ac5a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: frequencyfarmingscottish87.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'frequencyfarmingscottish87.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68b66da4-fa89-4735-ae27-29dcd4dad6e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshfieldlab-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshfieldlab-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5e5b6f58-1b4d-43f6-9e59-09fd18e2f7b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshfoxlab-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshfoxlab-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f50bcf5d-e8cf-4609-a01c-628e409d162c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshgridmail.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshgridmail.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--abb20712-8636-4a9c-882a-c1b3cdecee46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshly.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshly.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef86b291-755e-4188-b831-28641a44f15c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshnetbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshnetbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9d694a82-3332-46a7-9c66-5c70d5734f83",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshnetware.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshnetware.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cb8cb0ef-a457-457b-bc08-2f9225061a07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: freshroutehub.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'freshroutehub.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bb86271-8ea6-46db-8f5d-a05faee63939",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: friday-ad-verification.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'friday-ad-verification.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec23d5b0-6532-4c1d-9a36-f59c9d1dc30a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: friendsoffisheye.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'friendsoffisheye.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42e474fc-6189-4d8d-84dc-0d2cab3b4567",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: frizmo.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'frizmo.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e03fc1a4-677d-4aa2-9317-0cce7be6ac14",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: frlqi.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'frlqi.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdc2d498-a3b7-49b5-9949-974ae9458efd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: frtjzma.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'frtjzma.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c541aa0-9311-4c3a-b4cb-2755a1349a7e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: frub7nt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'frub7nt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08bfdfd5-21da-41c7-89bc-dfa5a6dee6f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fruehuhruhd.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fruehuhruhd.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fad09f16-0020-4d7c-8b67-0b7648c30f82",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fruitz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fruitz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c923fe45-1057-441d-87f5-dea4bf301a69",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: frxpzsiwems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'frxpzsiwems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f65764f-dcdf-460c-aed3-ba3b1e90dd28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fthclke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fthclke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7212ad2-0b06-4ed5-8ec4-30412cd102c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ftrzwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ftrzwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1534bb99-23b9-4413-922d-30c795bd3fc8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fu029.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fu029.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3b7ee4d-755f-4dba-8193-7f77b72ede7d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fu1sb323lhrnqxo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fu1sb323lhrnqxo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f13600d1-ea2d-4cc4-8e5e-644d3b695f45",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fuguo.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fuguo.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38e54538-f5c3-4c3f-9c50-c825e919efa4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fuilcopeac.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fuilcopeac.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0e19ea1-9228-4d78-930f-8f3acd88b988",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fukt6kxnpcr9zfb2268e9krkjuz.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fukt6kxnpcr9zfb2268e9krkjuz.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f23de36f-7a32-4d2a-b459-839ec0569ddf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fullskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fullskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a7093bd-c3fa-4606-9a3c-0f96c10aa819",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funhall.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funhall.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db541255-bf03-460b-bb1a-e5ef07ed2230",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funnelbdash.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funnelbdash.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09e70251-6faf-4220-9c02-98e8d1bf92a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funnelx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funnelx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd9c46c5-1b15-4e29-a4c6-57260795d960",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funnetech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funnetech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--806d1775-52a8-4357-957c-8d628cba3cdb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funnezone.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funnezone.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--288dd1ef-c4df-43c8-94ac-f669d0555f1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funseer.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funseer.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34575152-0e29-4802-a20f-368fd559e1c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: funtide.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'funtide.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bee733d-657b-46d4-aa1c-ebb443be4eb1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fupanep.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fupanep.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c40129b-03a3-4e07-85bd-d3a59dc1bf71",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: furbacz73vr0a1.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'furbacz73vr0a1.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5372304-8b71-4f0f-ad5e-372a74cf7d5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fusilbeetewklar.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fusilbeetewklar.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40e062e6-de86-443e-b42c-9b312c4b9d4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fusionincourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fusionincourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8ba64e0-91be-4d51-9c31-53a793b37dfa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: futbol-ispaniya-portugal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'futbol-ispaniya-portugal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16a81465-b074-46f3-9ea8-57861632bf8f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: futbol-match-portugal-ispaniya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'futbol-match-portugal-ispaniya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63d59b39-94a2-4254-93fc-87a97d6739cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: futbol-portugal-ispaniya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'futbol-portugal-ispaniya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6363877d-ab0f-44d3-9b09-6a4bdaf6a5a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fuwehiw.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fuwehiw.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15ada670-4ffd-4093-ac74-d47a58068f97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fuzhanggui.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fuzhanggui.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3332e9f-a3f6-4dac-af0f-dbeafa31c0c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fv541.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fv541.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a051a6fc-7648-4d85-af71-4a6908442a54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fvclwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fvclwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--682f8141-9653-41e4-922f-8aa82b34b60c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fvgtcke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fvgtcke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f01e415d-0b83-4495-8fed-aeaee4cad81f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fvqchke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fvqchke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--007d2a54-1b08-4b48-82f4-407ce4cfa7da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fvthwle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fvthwle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3be7901a-67b0-4280-a50d-cb171f31c0ab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fvxckhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fvxckhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f919e660-a7fb-4c0e-83fa-b20d91e7c424",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fwkxphe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fwkxphe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8cba7a5-3556-4663-b4cb-3e66d2453537",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fwwfw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fwwfw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15a96bfd-6459-49b9-acba-31657753dfac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fxnrqoa.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fxnrqoa.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5dd7146a-5596-4a40-82f2-d026d590b224",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fylzwcn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fylzwcn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6fcf773d-4096-4997-9a94-59be85607dee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fynesbxo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fynesbxo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be781ebc-dd39-4d35-9a1b-ebd11391e116",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fynjkqo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fynjkqo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56f35adc-686e-4952-afec-1f94b2e36029",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fynlor.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fynlor.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--39405a6a-6017-41c7-80f2-95243ae8cf4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fyntek.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fyntek.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c7cadca-e1e1-47e9-bca8-241952c6d242",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fynwkbx.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fynwkbx.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--595ddf1c-34f3-451e-9832-b0223209ce4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fzcmwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fzcmwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a30699e-8fa7-4a35-b96d-711da05f0023",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fzoaw0q.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fzoaw0q.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89d6d151-81f2-43fb-beaf-d66193e5a6de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: fzxhvre.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'fzxhvre.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e90f803-2bd6-4d12-8566-3c9e22a7e93b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: g35.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'g35.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--769d1cff-32f4-4950-8ba7-7bffafb67d3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: g3jsmh6.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'g3jsmh6.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32542056-f05a-4724-af54-f2751d0236d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: g5n.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'g5n.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--042ba1dc-3045-43b1-8a56-d93e02c629d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: g6ccmuo2c6m.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'g6ccmuo2c6m.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70efe0af-94be-44a0-848f-f4494c7cff94",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: g9g.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'g9g.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2df0c8b7-86aa-4562-8852-020bb9de9f28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ga8icc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ga8icc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83a3aa8a-b22c-403f-a451-ac0c8dc40379",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gaameoofbet.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gaameoofbet.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--218470f2-77a2-47a9-ad30-99f71a9b94c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gacorslot71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gacorslot71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--594a187d-fc35-458e-9470-d40c88951748",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gacorslot72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gacorslot72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d21bd99-e151-4d10-8c04-f2fb8d95ed1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gacorslotku215x.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gacorslotku215x.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4d87a9b-02b0-4091-bb8a-c364d522162f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gacorslotku216x.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gacorslotku216x.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23e2d82d-4b23-4c49-a5c0-186d0b1e7911",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gaeirjiko.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gaeirjiko.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0131d8fb-f5e3-4a92-8e3d-9a81979ceec6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gaentlunexeth.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gaentlunexeth.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--685f3f96-759d-45c5-8dce-4c24b50c01f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gahobom.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gahobom.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33003651-f51c-4079-8729-7b8d7defe616",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gakovleofivo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gakovleofivo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf9f40ab-a945-4319-b16d-227d6e3746be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: galabet-canli-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'galabet-canli-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--adb50a2d-5b63-4cfc-a278-12d867ee42ea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: galabet-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'galabet-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26c7be25-f251-4f29-9c15-f5a03872d701",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: galabet-resmiapp.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'galabet-resmiapp.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e77b7dc8-c8da-4081-98df-a3f06502662a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: galileiplinker.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'galileiplinker.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8925cc3f-0387-4222-a0c1-639605fe3f23",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: galunvraxlab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'galunvraxlab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb214593-657f-4bd2-a238-91b98d532cd4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gambit.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gambit.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0a572ab-4c06-4688-9617-6fe7b825a86c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: game-kult-fi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'game-kult-fi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f01bca6-4158-4249-ab6e-1e2d29b40ccf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gameclickers456.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gameclickers456.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b9936d3-f521-4039-90c6-033ba6870633",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gamequestathon789.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gamequestathon789.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f963cf3-cc86-427a-8f31-6162d118d41d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gamequesters555.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gamequesters555.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc7d9a9f-7208-4d95-ab18-177bfcf04306",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ganobetresmigiriss.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ganobetresmigiriss.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11e15e02-cfb2-4522-88a7-30b08824756f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gantrex.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gantrex.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cbd0141-7862-43f6-9ba9-4f203debe16d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: garuda138e7x.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'garuda138e7x.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fead6ecc-fd3a-4727-8479-68c5926edeff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: garuda365e70ip.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'garuda365e70ip.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d15a3d42-c49f-4bd3-932b-a3eca8831626",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gasaxtanaecime.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gasaxtanaecime.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e36064d-0ba6-4419-9aaa-a7bf60e700a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gates-olympus-fi.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gates-olympus-fi.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c76d09b-8ee5-4b26-9659-59f674cb8546",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gathercheer.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gathercheer.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f4853dc-a3c1-482d-9c95-a3dc41c50d63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gathercheers.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gathercheers.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--141d01e0-522d-4951-9c26-fa2da05756ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gaugetommy.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gaugetommy.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4a498a8a-c43e-454d-a26f-6ad2227a4f2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gavlen.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gavlen.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eef7150e-4f54-4d25-8b25-734fba643e02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gazinghorizon.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gazinghorizon.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ffb8fb1-ac23-4b76-a779-698637fe8bac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gazujoelentelis.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gazujoelentelis.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd7b9cdd-fa53-4235-a99a-1a70865f9746",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gbofkj8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gbofkj8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2827891-f786-4bd6-a65f-a29312a97457",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gcqz-adguard.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gcqz-adguard.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1ad26a4-c923-4ff0-988e-a7300618fe79",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gdboelv.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gdboelv.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c7ea264f-d74b-4648-b317-e4b346ab5a2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gdhsg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gdhsg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db98a2fe-b39d-4701-b44d-aa8ecb27074d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gebazoj.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gebazoj.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d846df7d-4193-4a63-aadb-c60e812ccdc7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gecocpibiko.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gecocpibiko.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18ff2f77-b078-4de9-aa3d-d87e1bb3fd44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gehewiy.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gehewiy.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12304c67-23ab-49dd-be56-653c28215f19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: geli5188.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'geli5188.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--006c9bd6-19a4-48e9-881c-7e23cb84a6e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gelidaemozione.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gelidaemozione.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--41db9f48-3e93-45c4-8527-2f2a48f336dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gemilangls.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gemilangls.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c62e6c1-fe9c-456a-b0d8-e952fc4c814e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: genetop.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'genetop.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2e431af-3c37-4e38-bfcf-c5c5ccf1fb8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: geninbugoeilero.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'geninbugoeilero.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--334e6ac8-0649-4d71-a626-13cf58e20b58",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: genioauchtsero.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'genioauchtsero.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db9aa7d1-e10e-4901-a5ff-042a30af3f07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: genrgs.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'genrgs.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db9ad0f1-9f8f-4d2c-a16c-d6f120d5bbb0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gercek-marsbahisgirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gercek-marsbahisgirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4a1eacc-0700-4657-bc80-bdd5efed30f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: germankremel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'germankremel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--478c46d3-cd58-4373-be78-3f36ee6d98ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: germanymaincente.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'germanymaincente.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5dda3f9-2a4e-46b3-931b-bcb7ac35682a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gervepe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gervepe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1adbb97-6274-413d-b1c3-e97c6f848878",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getanhubcore.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getanhubcore.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1585dc1-2e77-486c-92c3-e812161970f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getanhubplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getanhubplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--992204de-5bb8-4b43-a667-5d744f75844d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getanlabapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getanlabapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04ffb7d1-a469-43b1-8315-2a32e4af7cef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getanlabway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getanlabway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8a791dfb-1a77-44a1-bafe-986e8835d60a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getaquafusion.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getaquafusion.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9654a26-773d-4d49-8c61-bc494f89c4b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getboostgrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getboostgrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2ec2931-21bc-4bb0-b5e3-9233582529ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getboostlink.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getboostlink.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4bc8e9a-3754-465a-bbcc-59c1b912eae0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getboostnest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getboostnest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8ae5ddb5-11ca-43c5-a56a-23268b11ac4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getbwnpe.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getbwnpe.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--602b562a-c2d1-42b5-8909-0cc9491a3b24",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getbwnpeai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getbwnpeai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e48a927-e3cf-49dc-ba4c-0aa09d30bb36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getbwnpeline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getbwnpeline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bbb97f4-16d1-406a-86d3-f6014eaa4ac1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getbwnpetech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getbwnpetech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f739c1a-4e44-46da-88aa-56ca609cec4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getbwnpeview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getbwnpeview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0385686-ba2f-4330-98ba-4080928f6411",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getedsjeplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getedsjeplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12833752-0280-4334-acb7-b502a2d506c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcanai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcanai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b476692f-18f1-4824-9b3b-807c9da343bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcanapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcanapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd2c87bf-9387-4e52-a2b9-6878c531e177",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcanbase.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcanbase.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--feb4ad62-5f44-469b-bd34-a259638423cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcanhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcanhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27524d82-6489-4e07-9723-fb584a977b2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcansite.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcansite.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e021534b-0f77-4612-969c-dd67b3bb53be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcanspot.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcanspot.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--86ac03a4-3df3-4e68-a389-da92173f2332",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getelcantech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getelcantech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bea7cc17-7f2f-4937-8f1a-5181774d6555",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getewhubweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getewhubweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd313869-962e-41b7-bdba-2078751e3553",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getf0hb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getf0hb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6bdcdc04-2cdb-4647-b6bf-2bacf4b1c3eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getfunnelb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getfunnelb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2c9c153-4b52-45f8-8bbe-d3d2b2f388cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getfunnelbhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getfunnelbhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0fcd1e9-9d77-4ab8-9075-1c2ba1723a3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getfunneld.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getfunneld.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68a715a7-46bc-40da-8762-c8bcbb9fec24",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getfunnelk.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getfunnelk.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa36835f-1f21-4fef-8d56-49e3dde67e9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getleadkbase.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getleadkbase.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a1e626ee-a58b-4b85-ab88-536e00166725",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getleadkly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getleadkly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5051315-ea4b-434e-94ff-eaa48917601e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getleadknest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getleadknest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--018abc69-4723-4b5f-90dc-1b3e77ae142d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getleadksky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getleadksky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ca0c04c-9e80-4394-8454-69dd97c20101",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnflowcore.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnflowcore.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a18d9b81-2e84-4dd5-9579-3065ad843db4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnflowdash.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnflowdash.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd8e465a-9969-43b0-8e1c-8156efd1bbfc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnflowhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnflowhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ed7f2eb-0b76-4aa7-a417-08dcae46ef4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnflowline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnflowline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06110b6a-defa-41c7-98d7-11bb627628ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnflowway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnflowway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a181892c-badc-41ad-912a-2056f1cbc222",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnsyncai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnsyncai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7f7a07f-6f1c-48c2-b18a-847bf29c4be0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnsyncapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnsyncapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--130099ba-32f8-49d8-b4d1-6d19dc713bd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnsyncline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnsyncline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--441bcc8c-1163-4389-a39c-305643a6297f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnsynclink.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnsynclink.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--724de7cb-d59b-471a-a74b-9163a2ad4ddc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getnsyncway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getnsyncway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73f2f7bf-f237-418f-97ac-d7c814811a22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getrowth.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getrowth.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d0da45f-5b04-4a80-a6ee-0d637cb339b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getrowthline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getrowthline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a57c574-d4e2-4af2-8e1a-cd61ee3ae352",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getscalehub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getscalehub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44b471a9-b052-4142-aa6d-e2bb8be10601",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getviralbase.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getviralbase.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee8cb11e-9f7e-4fc0-a2d9-a28222ea96e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getviralbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getviralbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55f26863-c8a0-4382-9fbb-ea21fb1216ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getwsynchq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getwsynchq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa698261-8379-44b3-b37f-4d9861c45d78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getwsyncstar.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getwsyncstar.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--acdd3527-4e7f-4ab6-b147-14fd9703a8de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: getwsyncview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'getwsyncview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--90462de5-4745-402f-b0ae-94de07fc053e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gf4bdr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gf4bdr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbca396e-34f4-4ff8-9a80-2c3189f82ee9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gfzxjz2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gfzxjz2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f45fe55b-eac4-4eeb-b195-699e534ad807",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gg-tv-app.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gg-tv-app.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dcfaa85e-1492-4e89-b034-9d300348a536",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gg288m.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gg288m.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96da2c46-8678-4186-9ea9-eeb4f100df54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggq.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggq.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0f33e5ac-a611-4e8a-8294-d1019c5c4f0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-ap-free.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-ap-free.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--042b79be-4f54-4424-af0b-9b83d9478175",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-nigeria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-nigeria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9449d2a-e492-4711-916e-f3bdadb669f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-pakistan1-1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-pakistan1-1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--74a879b4-eb37-49a5-b12e-42226f546174",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-pakistan1-2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-pakistan1-2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1fe05d8-0a47-446e-a520-b30495795587",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-pakistan1-3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-pakistan1-3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--313c19d2-ac51-433c-bfed-7979f5cf7e47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-pakistan2-1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-pakistan2-1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f138e099-99d7-48e6-80da-12cc81759794",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-pakistan2-2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-pakistan2-2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75ff593f-508b-4b87-996c-bd368313d98b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggtv-pakistan2-3.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggtv-pakistan2-3.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae9b95d3-0ed5-4e87-ab0f-3b9132c5ccda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ggz.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ggz.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--974938ce-6f32-4a4e-8c6d-6c133040def3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gh4dn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gh4dn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6c85a95-b51e-4c0c-8c56-d3c9e0eb84dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gh4mmu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gh4mmu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb7b88f9-2e39-484e-a65c-61004a950850",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghagghg.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghagghg.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aed21d56-2329-44a9-a292-8a3617593832",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghalcken.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghalcken.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ba404fa-92ac-4ce3-9539-b0e87ae32dad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghanapostsdf.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghanapostsdf.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d3f8a918-4fc9-42e7-b578-3f2ac5d5f26c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghhjjbf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghhjjbf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a78f40b1-6bbd-4fae-8590-d2d88f8ed5ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghjdgbaa1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghjdgbaa1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9fa2a0a-576c-4737-8802-56bec74e8c79",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghktyvo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghktyvo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df0257ab-61ff-4cde-8f58-57e188cdeea3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghostspecter.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghostspecter.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e92b6cae-68b4-48f0-a647-837ab08f6f3f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghvskfs.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghvskfs.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09b67280-264d-4ed7-a576-2ec227d40c05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ghvzcra.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ghvzcra.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17c8d1f8-f1f7-486a-8769-4935d8098baf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gi2mqf.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gi2mqf.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--389a7f3e-ad2f-42fb-aaab-ee9c669bb687",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: giffgaff-network.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'giffgaff-network.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59df732e-fc66-4c6a-a428-66d81eb2adde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: giffgaffmobile.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'giffgaffmobile.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--708b38d7-3bca-44f6-9e77-a568b8181174",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gikufem.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gikufem.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8e53e05-bd4b-4ade-88af-8c0ff5579f92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gilfhguyihughv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gilfhguyihughv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a84c43af-a2e8-4fdc-8638-387d69359a08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gilgiapastry.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gilgiapastry.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16105dc0-990d-4843-afd7-1c924723be10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gilodan.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gilodan.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--874a1111-109f-4415-ba2a-5c3dd4a093c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gilplay323.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gilplay323.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80a3ec6a-50c1-4608-b5f1-14a5cd79a723",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gimppiensavgon.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gimppiensavgon.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5769e2ee-8236-46ba-8aef-cd0ea4d5a959",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: giqlundu.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'giqlundu.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--645e6b04-e17b-4102-b41c-30807f666e42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: girise.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'girise.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c35dc91-62ae-4f1d-8fb9-5aa54d60fdfc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: girissadresim1.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'girissadresim1.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46fe25f9-d507-431c-9187-f56f4ae29b9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: girissadresim2.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'girissadresim2.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13e318b9-a387-4f21-b875-6e36d8053d0a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: girisyap.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'girisyap.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f17fde5-fd74-4ec7-8158-3cfef0a03a18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: girnofe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'girnofe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--940689d1-f213-49ac-9456-c4dd0f131d04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: giwikal.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'giwikal.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8951688f-9339-459b-b131-e0deb33fbe6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixdae.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixdae.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--801612ce-7437-4178-8b5b-98301595f595",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixfae.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixfae.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--420a458b-80b5-4206-b4d6-30e718f73292",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixfoe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixfoe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7cadb5c1-7c10-4bd3-acfd-13fc3057d32e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixnae.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixnae.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79eaec74-ad9c-4848-89f8-20871cd2cb22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixnoe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixnoe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5e0250b-7e74-4235-b2d9-83a3d76cf56f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixrae.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixrae.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7835188-7185-4309-93db-dbaa97988e63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixroe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixroe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fae198cc-bb9f-4309-9b98-2bf1d8480ddf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixzae.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixzae.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a2778b61-5b6c-4ace-b5d7-d3a86e235f8f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gixzoe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gixzoe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea821f4c-5cc5-42b7-8ace-e8d3825b5323",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gizd2ad.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gizd2ad.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa88343d-a71b-486f-9443-2353d6d7ab88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1a1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1a1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--654c3443-2492-4cd2-8648-13f8ecc9e681",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1b2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1b2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e742f027-036b-4537-94ae-1e17e9c19592",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1c3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1c3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0617594a-ebcd-459d-adc0-f4f8760f4c47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1d4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1d4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6ccc057-295e-4de3-81fd-af299a4ae0a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1e5.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1e5.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb029837-0e7a-42fc-ae08-cf51758a80cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1f6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1f6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--868c39be-202f-48ee-8bf3-e26d2a43d90c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1g7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1g7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0824b8e-daec-4a47-9379-3705cab4f349",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1h8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1h8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b22121de-7d42-4756-b6ca-8dbee82687aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1i9.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1i9.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9785a660-20d5-488e-b877-23636785e7a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1j10.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1j10.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7597ed2b-8bd0-4029-aac5-0333d2d1ac12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1k11.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1k11.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--980a5e6e-ee24-49b0-a7e3-189cfce1119d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1l12.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1l12.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a8eda08-a089-4e2c-9b7a-095dca46463e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1m13.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1m13.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d90d7356-ff6c-4181-80b3-5be04d1706b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1n14.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1n14.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7accb6e9-7607-4de8-9117-ed01e880ab4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjp555777188h1o15.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjp555777188h1o15.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0385493c-c6eb-481a-a405-6b499bea759d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gjqylfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gjqylfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c11b666e-0d43-4953-816d-650379046fb0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gkqnyvo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gkqnyvo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2bfc0f89-b98a-4382-9a3f-26611168452f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glassdor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glassdor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37d30f2f-8667-4cd9-878a-277c65919e57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glimmerbrook.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glimmerbrook.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15ea6b9d-ee33-4303-ae08-fee7142921aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glintly.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glintly.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5618a719-1ace-4f94-b8e6-f885c6168ab3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glis-groupea.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glis-groupea.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2706c98e-208a-4780-9acd-bfedcf855f1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glitikmaco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glitikmaco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--08cd5f7d-b403-4585-845e-554246631ae0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: globalpilot.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'globalpilot.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa1c8f04-31c6-4f67-8f98-7a79630feda5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: globalpilot.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'globalpilot.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89a806f7-093c-4085-a38e-a2d4bdb76eee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: globalstudio622.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'globalstudio622.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63684544-f941-40d8-b174-b770b9d4a988",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: globaltaxwise.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'globaltaxwise.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4bc92d00-c9e7-4be8-a02e-f03c0e246614",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: globaltravelreviews.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'globaltravelreviews.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06f59ddd-cfa2-4977-ab7f-f5cbca969c5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glomix.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glomix.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50f2e285-9f4d-478e-bf7e-9a95e0d30dfc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glorystarbetpkr.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glorystarbetpkr.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--098f4a85-a8b4-4ee3-8615-b6513f27de44",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: glovingaeolus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'glovingaeolus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--620be68d-00fe-40bd-a868-861ed75bc6f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-groupp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-groupp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--166ab7a1-5103-4fa5-9c03-f5a8688819e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-groupre.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-groupre.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db59289f-7810-4733-a8db-3a8d4057e256",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-grouvp.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-grouvp.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f21daa26-1bbe-4f48-afbc-b732f4bc4391",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-grouxp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-grouxp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7739aa0-9c82-461c-b88f-1d0885d62c51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-grvoup.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-grvoup.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ceac1fdd-e38b-4a63-b3d4-2bcc35882487",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-grzoup.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-grzoup.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff4b08fa-8c5f-4f2e-aefe-02ff68b53909",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-ptreu.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-ptreu.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--842ebca6-5935-45d8-a022-2ade2a967dde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-ptrsn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-ptrsn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--da9d7646-c57d-4bdb-b9a5-a333b4b7e131",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gls-tpogroup.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gls-tpogroup.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--031393fd-bcb1-4a34-a785-7b8ec086ee5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gm077.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gm077.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7cd977ff-ee81-44b6-badc-db653ffb8b4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gm8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gm8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63aa8d58-cb26-4d95-8632-6d44a4cf4d1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gmptyfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gmptyfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4389f9f4-4763-4508-8366-4563126304a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gnkmqwe.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gnkmqwe.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d134413b-ba7c-40da-bc2b-e568b4ec96bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gnpskr.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gnpskr.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc232907-c78f-4f89-9a48-510c1f19dad0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gntskr.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gntskr.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49a9ddee-3784-46a8-ac61-b3e1bdc74c75",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gntskr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gntskr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00cccb2c-f417-49e5-bf70-4c1c7a1a749e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goal26.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goal26.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68aeb1a9-c21e-4e61-93d0-0031ffd561c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goal26.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goal26.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7fd1c131-f56c-4112-a406-fedd8ef60769",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanhubapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanhubapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--772b9db6-6693-4470-b8b7-e2a947bf6889",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanhubgrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanhubgrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55750415-fcbb-46b0-a0e0-d0030e8ebeb0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanhubhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanhubhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a13254b-78ae-4a1d-b547-abae91f3c082",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanhubify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanhubify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f069b4e-204f-4c5d-a420-40ef63a6f29d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanhubstar.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanhubstar.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e4b7324-72a2-42d0-bf18-217ade8745bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanlabai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanlabai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7fa8c8b2-57fd-485a-bb43-878841b1ffa0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanlabtech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanlabtech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2a78189-5535-4d22-ab99-ee33df397d74",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goanlabweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goanlabweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5424aa5-3028-4365-9d03-b5c86c5f369c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gobax.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gobax.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49c63d65-0f21-4820-b180-736029a77fe1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goboostify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goboostify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9020017e-6b36-4b7b-b4a7-c8821f4f2c3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goboostview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goboostview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ba37a2a-2e14-470b-8d04-0206c0c810c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gobwnpeai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gobwnpeai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f55038ee-3528-4e7f-bf6d-54d77db2054e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gobwnpegrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gobwnpegrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ec09a47-9652-4201-b7c7-dc7c4a280262",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gobwnpesite.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gobwnpesite.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--107cfb0d-39c6-49a7-b346-54c7e34d805f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: godaxekare.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'godaxekare.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26b882b5-e979-4016-9aa9-6e263108063d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: godocdolelaakepo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'godocdolelaakepo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d26db328-0fb1-42ac-bca3-a4066f4793b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goenaewline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goenaewline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03bfe995-8cf5-4878-affd-d98ccf057414",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goetricline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goetricline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a062dd7d-d8ad-4de5-9321-549163a03d9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goetricplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goetricplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a0efb9b-d291-4390-b126-fea3ccf30770",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gofatreeoezaco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gofatreeoezaco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7a3c9a5-2ed0-4131-b1ce-43b643a684fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goffice.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goffice.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--528579b0-c2bf-434d-b032-432ed3497db7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gofunnelbify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gofunnelbify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b251fa8-ce7a-4c65-9a92-d7de4e92508b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gogevur.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gogevur.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1cdf9d8-317e-4da0-9b98-22e00069c86e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gohafnarh.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gohafnarh.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8bebadd-3a11-41e3-be34-f49315f1a949",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldcloudzone-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldcloudzone-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--749d293d-175b-4026-a50e-0aa1987a8eb3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: golden-joy-haven.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'golden-joy-haven.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc551d8e-0669-4383-a3d9-557166b93dcf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldengames.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldengames.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62ffe5c6-b50c-4e5f-971b-8691e4f79c12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldfieldbase-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldfieldbase-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82641bc7-bcb3-4c3b-97a1-489f322b02c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldfieldhub-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldfieldhub-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95c4b7a2-83a9-4e76-a8c3-0d75f9593ef4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldgoldgold.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldgoldgold.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c36ffcca-2a92-4e79-aa60-e9d2040c9185",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldlionport-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldlionport-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8866d03d-8b71-495e-a78c-c6d49267d84e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldpixelbox-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldpixelbox-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c75d455b-acd6-4c28-bc05-7e2aa0816f67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldroadhub-uty.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldroadhub-uty.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65cbc2da-0872-4bcb-a130-5299ab56e032",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goldwaveline-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goldwaveline-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bd394e4-34b4-4c36-b11a-44610081e793",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goleadbdash.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goleadbdash.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c564f5f3-98b7-4112-9460-5460e74bdb39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goleadbway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goleadbway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b9bf324-b1fb-4f3e-b8d0-fb84d9358880",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goleaddrohub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goleaddrohub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f561014c-cf28-4b5b-bbce-db64c45f2939",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goleadkwnapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goleadkwnapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ffd1e9b-e242-41ea-8ba2-6403852f7ff5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: golibmeifoxi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'golibmeifoxi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8dafe79d-7a72-47d7-99f9-6a1afcf87214",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gomerpaviaidoge.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gomerpaviaidoge.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54fdbab7-31ac-42f0-a657-92db608f65e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gonflowhq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gonflowhq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5c49f51-c3a4-4fac-a323-b40f55f38bc0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gonflowzone.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gonflowzone.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de85a8ca-60f8-4cfd-91fa-4415c23005aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gonogponaviajeki.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gonogponaviajeki.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93ad866e-b00d-467e-9764-62325f5356b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gonsyncbase.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gonsyncbase.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0178b9af-d729-447c-b457-5b3b68449334",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gonsyncdash.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gonsyncdash.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a193bd4-d05c-4233-bb78-513d59a963aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gonsyncset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gonsyncset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efd77fc5-260d-41cd-ab4b-454ca4bedbbe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goodstack.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goodstack.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3d5a5e6-f381-4f66-af16-6c3222fb9223",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gooning.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gooning.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad18fff2-b7e9-47a1-b0c3-a71eb6efff11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gora-bet.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gora-bet.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e60095e8-661a-4558-a8dc-4f3d29125028",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gorabett.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gorabett.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b786839-8842-4453-bc85-bfc2570a2cd9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gorowthline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gorowthline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89b1431e-cf01-4c41-bce2-b11a724996eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gorowthsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gorowthsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38a1263f-d5cd-4beb-935a-171195e06fad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gosmartdrai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gosmartdrai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fbef035-488f-4ac9-bbfc-cb85531883e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gosmartkwbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gosmartkwbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e29369ba-0092-48af-8df2-dce284ee3fe9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gosmartkwly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gosmartkwly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e780d19-c8a0-4d18-845e-0ee38bf4e7d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goszashchita-kinoteatr.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goszashchita-kinoteatr.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a57610fa-8080-499f-81a2-72f5ae7fca40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptes.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptes.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc84bb6c-84c9-4d8b-a60a-a49d32fc9247",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-pteu.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-pteu.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38f846eb-7dc1-4a81-a0fc-2510f2fff4e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptez.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptez.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49024857-de59-46b3-9ca6-612795e18b5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptses.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptses.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3c2ccf5-8c4c-4a26-b356-65118f3cf4bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptseu.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptseu.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a6ece99-8f13-411e-8c46-34bc40e771db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptsos.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptsos.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b61f8a79-6150-47f5-b726-c1272fa8d1d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptsrs.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptsrs.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e491490b-cc7c-4058-90e6-a240fd4d5ba8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptsvs.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptsvs.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87600666-f519-4d18-8d70-35de1ee3a5ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gov-ptszs.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gov-ptszs.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbc58eeb-97b5-4cd0-bbb6-a44b55e91dab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: govfiness.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'govfiness.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e91017b-bfb7-4510-9577-c385213cc206",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goviralbwbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goviralbwbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2f6000bb-3660-4f1d-88e5-693c332839c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goviralkwapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goviralkwapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00eddc6f-1675-421b-9a0b-bc2496333951",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goviralkwify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goviralkwify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1943b2ed-7bb3-4309-ad27-79bce8485ba2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goviralkwly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goviralkwly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d250d438-9fec-4dde-bcf0-29171a2175e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: govpaya.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'govpaya.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a72e25b9-5cb5-4dcf-b220-b4d04f06a0c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: goyangasyik.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'goyangasyik.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d385dc0-714f-4505-b753-21fa800d3a0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gpdrxja.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gpdrxja.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b877bae-3ebb-4075-96a9-d608e9964658",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gpjynfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gpjynfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dba4ae09-7074-4d9d-a632-fbc509832993",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gprjlwm.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gprjlwm.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7a04905-e6e1-426f-8cce-d3d180c8c616",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gpttechrise.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gpttechrise.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a4cb2ae-c1ea-4f5c-9327-4f586130ef32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gq6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gq6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a717098a-0537-468a-8789-fde47f8f4024",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqcmyfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqcmyfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b124945-766a-4d8a-b4fe-96c60f28f85f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqf.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqf.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad9ac41a-044b-45b0-b44e-bec8bbbe343d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqmnyra.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqmnyra.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9bb64de1-d9d8-46e1-8b30-33f87e44477f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqnlyvo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqnlyvo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c300a84-1c29-4ead-a3ba-fcbc689dab4f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqphyno.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqphyno.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4737883-3ede-427f-8cba-cf9c0b4f2c52",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqpxyno.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqpxyno.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4fc6dad6-b29c-4a04-8e2b-c80d4b880bb8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gqtywno.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gqtywno.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--291f1968-cf22-4520-9fe3-8389d849bf94",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gr1p-veltr1x.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gr1p-veltr1x.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9722bc74-f13c-4de9-8345-d88287700162",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gracjanzbierski.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gracjanzbierski.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--362980be-3b0f-4d7e-ba8e-ed9607599c47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gram.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gram.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d6f4a1d-5537-4d6e-8a6a-9b835fdc2248",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grand-boost-winonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grand-boost-winonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80bc7d4f-0e60-4658-8efe-50f907aa6091",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grand-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grand-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0bcb0ab4-4d93-4728-a9f5-f00e8b47402a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grand-boostwindfall-kz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grand-boostwindfall-kz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49b57af8-d8de-49b2-81c0-363b307303e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grand-enableboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grand-enableboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d0cb72e-e829-4383-9dc3-8abae79d295b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grand-kz-boostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grand-kz-boostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bbdd171a-f739-4bc3-8b2b-e620c5794d29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grand-kzboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grand-kzboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3ac832b-80be-4480-9ad5-ab6e83035071",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandbahis.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandbahis.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c559e17-85e9-400d-a03e-55c831904d89",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandfxpro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandfxpro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61053d90-df4f-47e8-9295-504b58b1b047",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandline.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandline.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c439f7c5-1ce6-40dd-9648-5719c0b0a583",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpasagiris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpasagiris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f8a0a13-1bb9-4556-9d5c-124946fbe39b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpasha-bet-mobil59.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpasha-bet-mobil59.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c2e608c-e45b-44ff-aad9-10d4597c3ca9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-2026gir.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-2026gir.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16fe1621-cdb8-4045-b719-0a090e39e2bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c061590a-6531-42f4-a3ac-6d0f1bdff3bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-gir13.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-gir13.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6e9b2b3-c3c3-451d-be9d-a0d957273150",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-girisle.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-girisle.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--711e46b2-cf02-4724-be59-5e9c94025675",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-orijinal.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-orijinal.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--856adaad-6c20-478b-b3ca-197ec7e36093",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-orijinalgir.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-orijinalgir.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0255029a-b231-4857-91c0-e3026dd7e827",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabet-resmiadres.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabet-resmiadres.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75f55da5-b300-407d-8863-64e2210e496d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabetim-2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabetim-2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9417f66c-8b9b-4498-97f6-4b8ee9155ffe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabetkazan.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabetkazan.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f38ada91-c5ed-4156-ad0d-3eb1204684b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabetmobil-orjinal.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabetmobil-orjinal.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8b4929c-d576-4ab3-a816-02e99952e138",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabetorj-mobil.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabetorj-mobil.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70019119-233b-485c-9f9c-8b523f263075",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabetturkeylive.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabetturkeylive.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f91dbd71-84cb-4ca3-8faa-fae325587eba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabt-player2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabt-player2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0bf1104-ee4e-4b1d-98ab-e79ce3625ef5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grandpashabtofcal-adres.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grandpashabtofcal-adres.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cadd027f-37c5-4138-a33a-1c517037fcba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gravitonloop.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gravitonloop.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03031f02-2127-4aef-9937-3600c668992e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grazynamarciniak.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grazynamarciniak.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b495e67f-8f9f-468a-b0ff-34a4fbe7f98f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greatskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greatskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03f67477-596c-4f58-85cc-53a7e53947be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grecerephaellotoses.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grecerephaellotoses.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0febcade-e0ed-46bd-9d68-7c4c73c3f1b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greencitynode-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greencitynode-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3fccdf55-5050-41a4-869a-929ba8dff0a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenfieldport-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenfieldport-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--da864714-19b1-418e-8f4d-c5a0efaca2b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenreview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenreview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9728d50-8c12-41a6-95b0-a9b10af8aabf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenreviewbrand.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenreviewbrand.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d1d1fad-3626-4344-97be-6308e329190b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenreviewbrandpromote.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenreviewbrandpromote.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c3d4531-820b-4989-89ee-b1aaf00c7bab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenstonelab-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenstonelab-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83fe4a9c-7492-486c-8ac8-261b916c2c3d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenstonenet-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenstonenet-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2804ab43-f625-4078-97f7-6cc600a41986",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greenup.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greenup.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58c67d61-9fa1-4fd3-b754-7a5446e2f22b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: greg.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'greg.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e3b7f32-5c4f-4ecd-8b24-828484d2e7df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gression.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gression.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--832ac886-fdb8-45e3-aa52-d80d3d642651",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gridon.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gridon.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ba2684e-0f78-44e7-a886-26707616fb03",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grjiks.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grjiks.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa282d93-3259-459c-b849-d6ff0f76903a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gromalove.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gromalove.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4f293df-590f-49f1-b553-05e95d62caf1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gronpt.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gronpt.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2dc7378d-5e7b-471d-b778-6027498eafe5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grouop.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grouop.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a734d0ee-35eb-494b-bced-496d42754e15",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: group-gls.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'group-gls.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5d9d580-b71b-4287-98d1-ccf8b1625f3a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: group-gls.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'group-gls.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42652d8f-e663-45f1-af2c-f5748e05bd95",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: groupbii.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'groupbii.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85394397-acea-452e-b4c4-50e65ed562f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: groutorantes.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'groutorantes.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61594b28-c95a-4b21-bb42-9166f7762e30",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grovestion.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grovestion.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71ea5fad-28d8-49c1-8c2a-7643f4783923",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: growfast.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'growfast.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19155aca-4a85-4861-bed5-16b1cdb9dcb7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: growhit.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'growhit.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7d2a12b-c065-46ac-89a2-d3fe5e8be8b3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: growhub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'growhub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab4f1c09-1db8-43ac-9fe3-d3827ce87181",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: growmetric.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'growmetric.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0567d83-4e15-4350-a55a-a54c1df820e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: growtea.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'growtea.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88c3539f-65a6-46ca-b9f6-4f57e39c6679",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: growth-romv.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'growth-romv.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6547d4a-3b43-4128-997d-af74958e8941",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grqkpya.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grqkpya.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b470aa8e-53da-4ffd-8859-2863ae259df1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grqxnle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grqxnle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29622d52-1962-49f2-894e-61a5eb799dbe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grumesjoe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grumesjoe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc67e761-9b0d-46ba-9033-67a8cc7e16e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grxptwe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grxptwe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4f73660-c364-40b0-b2a5-8c2b250bcab8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: grxpzsiwems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'grxpzsiwems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c15aeb8c-9b0f-4b2a-a467-b63a32a2b61e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gthcpke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gthcpke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e138730-a44c-4272-9eb2-1feed2d7cbae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gtxbet.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gtxbet.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23a8949b-4d90-4ee6-877e-ecea7ab6da87",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gtzfa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gtzfa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e68aa73-57fc-4641-8d49-3640ca4a8ce7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gu3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gu3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee50467b-a6f9-4487-9998-d88dd445216b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gu412.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gu412.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88b5762d-b8ad-48c0-b3b9-59453d355fb7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guaduaw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guaduaw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2244da66-2773-47a5-9122-2149fb68275a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guapuruvupss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guapuruvupss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a9beb5b-8c19-4a29-bdd7-13e96b56cda9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guerntraie.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guerntraie.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff0f676c-56c4-4a81-bca7-b91105f8a6b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guestpath.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guestpath.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--947a3f4d-caa8-4b64-a973-58fb4ce13736",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guhunol.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guhunol.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb23c031-7cc0-4b3e-82e0-bdffbc004fc9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guiacatolico.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guiacatolico.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--066d376d-0228-44c2-b91b-c27c594454aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guidinglightmedia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guidinglightmedia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d46de93d-1b45-4236-ac6b-9839ad7c9110",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gulistangultas.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gulistangultas.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b11f590e-1281-4568-93e4-ce6b9714a183",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gumttree.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gumttree.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ca557dc-4ff6-44b1-b295-d683aded6da5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guncelgirisadresimiz2026.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guncelgirisadresimiz2026.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--213c673c-25a9-4d81-86b6-759c106d8510",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guncelgirisim.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guncelgirisim.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1966a8c-7b06-438b-834a-96d6682e7917",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guo-cs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guo-cs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c0a839c-d246-4eab-aa0a-fdf7959250c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guoccp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guoccp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc3b003e-a15d-4ec6-b24b-babb34f9afce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guoeav.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guoeav.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dde3558e-7973-400e-9fd8-5573ed1ed606",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d07c62a0-d12d-44cc-aeb4-3b27a5a9266a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68bff55c-9c03-4fbf-978d-82c1bcc64e62",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs69.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs69.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--546fb880-00ec-40b7-90f9-dde10c696e98",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs91.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs91.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d23d828-5a10-476c-9998-0abc3270d4a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs91.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs91.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75a244f5-0179-40a2-a37a-84ea654d687f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs98.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs98.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--240154a6-4b12-470e-8aa4-83fcb752a607",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guofs98.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guofs98.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37b86be5-e130-45e3-b505-acdd80be4369",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guojs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guojs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c8f8c35-97ed-4fec-a83b-a6d6434ff8c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gusoruh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gusoruh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d6b4b8f1-ef9d-4fd6-9704-799659b8cdea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gustusnidgety.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gustusnidgety.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9688bf2-6390-46d2-a2ee-1f570fbc7a16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guvenilirbahislerim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guvenilirbahislerim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2debf031-f006-4df0-9322-23219fa8f758",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: guvenilircasinolarim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'guvenilircasinolarim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdaad9b4-8f73-4e27-9df3-8468202b66c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gwrrxlqp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gwrrxlqp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2daca523-e809-4ef0-b8fc-de392351bdde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0a1.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0a1.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d45877a5-0eae-43fb-bdc9-eade2deb6d6d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0b2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0b2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20a6c6d4-306b-4c78-88f4-e1c1a4c6f7a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0c3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0c3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d47e5e6-7de3-4fbe-aebb-90e250efde22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0d4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0d4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e9075df-e205-4098-8708-5b90423bec9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0e5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0e5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a55963a7-97c9-4816-947a-4f114c1f5206",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0f6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0f6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdf97f2f-9e98-442a-a654-7afef57fc936",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0g7.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0g7.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f782bc7-8357-4d52-aa1e-a2d97e3f042e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0h8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0h8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0457e60a-3c7f-4b06-b6ad-8413c019145d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0i9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0i9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae8ac0d1-d6a9-4eb4-97bd-94cd7949c28d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0j10.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0j10.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eede9435-3f43-42ef-8fff-7ce79bfe9320",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0k11.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0k11.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4817a682-42b5-4d71-8920-a157586ccc28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0l12.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0l12.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c539eca6-6eb0-4156-b907-aef91b3414f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0m13.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0m13.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92c07584-22e4-4a3a-89e6-975e8c987156",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0n14.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0n14.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0aae260b-9da4-4566-bd5f-61a80a095eb5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxfc84146662k0o15.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxfc84146662k0o15.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0589b405-28bf-457f-a9c4-b175bedae7e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gxg8i.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gxg8i.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--496175da-6428-4963-8544-e24f52383b3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gy7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gy7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be3c18d8-58f5-4dba-bad0-b50ab0df02a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gyc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gyc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--142cbcb0-df3d-4033-9d52-a3ae462d6071",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gyvestaxis.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gyvestaxis.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fa8d3050-c488-469f-8209-ea6e17d0f2f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gz3.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gz3.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1fe21645-2d32-46f6-b4ac-80b7fa8eb768",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gz74c.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gz74c.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--152c406b-2acf-44fc-b265-874bdf27a31e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gz794.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gz794.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a57daa97-2954-4cef-962b-a5e8a9705392",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: gzrz2yz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'gzrz2yz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22f57f8f-25dd-4326-8dd9-75b19378f6ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h2d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h2d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24c83694-3e6f-4326-a3cf-f9762b6b9cd7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h2g.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h2g.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ce8da69-696c-4e25-9a5d-c5aa5090b19c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h2lym.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h2lym.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc9f0047-f099-4fba-8078-1fab40d05c29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h3b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h3b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25014e6e-51a0-4e0d-bd1f-b7a7ceb901d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h6v.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h6v.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2d143f2-84cb-44cd-a5cb-876263f46e64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h7b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h7b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1f1f783-3ae0-4186-935a-82f5bde4a985",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h7s.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h7s.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce32c3a6-8a78-4b4e-8e1c-c6ef3e408270",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h8a.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h8a.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--283058d7-1a8c-4dd8-a03f-2563b74fd8de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h97.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h97.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5fd0409-89a8-4325-bdba-8d65468c1b85",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h98.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h98.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06352ded-45c5-44a5-8b15-4780d04efeda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: h9d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'h9d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e37b463-72d6-4a6d-980b-a414d6c5e627",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: habelcebato.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'habelcebato.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--828b480e-db36-4a47-bd93-87ec8a5ab5a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hafilfeoraavabu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hafilfeoraavabu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9efea892-def1-4198-b4ca-179e5172e42e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: haha303best.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'haha303best.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c379b699-10d2-4981-abdf-a79c1ab026a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hahodob.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hahodob.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--54889a30-11e9-4559-b898-b43f6e4bbbfe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hailoka.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hailoka.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30b21fac-eac4-4f2d-8d7d-c3596640546e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: halkbanek.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'halkbanek.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdb17421-a316-411e-a3ac-876fe4deccd9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: haloapex.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'haloapex.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--362b30e8-08e1-4d81-9443-6a2f7e01882b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: halorqemhub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'halorqemhub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--122f51fc-4d25-4227-a947-33c0281ae806",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hamyaranip.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hamyaranip.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80c0a646-0b58-4136-87a7-c38244eeeb5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: handbiacer.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'handbiacer.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9dea01c0-ca92-4f3f-b0a7-e6168bc37892",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: handsoncourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'handsoncourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f1c8477-8511-4a5f-8c53-33e179261356",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hannaszczerba.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hannaszczerba.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7d0f1a87-2314-4ef2-8767-d591a47c1ec6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hannaszulter.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hannaszulter.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c33b2b71-1b51-4db3-98f0-435a1e793cbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hanyubaig.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hanyubaig.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb6b5696-e920-4097-b4d3-92914dfe0015",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hanzms.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hanzms.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f17da59-8d8c-45dc-881b-f33b6bf31c07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: haoyunxiaoqian.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'haoyunxiaoqian.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88627fd4-7d95-416e-9fe7-48b8d27dcb42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: harborhurried.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'harborhurried.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--410ae19c-f87a-40a1-91c9-348559b7e5ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: harefif.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'harefif.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b02ee446-8e5c-42ee-8a2d-11acb9dd49bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: harum4d77bvcx.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'harum4d77bvcx.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bbf2bd3-98d6-4ff5-bf52-344471166ba9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hattori.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hattori.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2730a472-e59b-4bce-a87d-8099b9e14608",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hbfebfhfe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hbfebfhfe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--941cb451-a720-4e46-94f7-d07babe985a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hbssa-a5xalxxzts0jf.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hbssa-a5xalxxzts0jf.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a410d8f6-3cd1-4b52-98df-8b39c15426a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hbwplze.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hbwplze.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e5d5169-dc7c-41c8-b4da-0d223a577f51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hc687.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hc687.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b82c5d1-3a1c-4581-8383-aa4d0085d122",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hc751.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hc751.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f70544c-f627-4834-95d9-532c4d79d00d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hc858.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hc858.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b534f375-2a06-4cdc-8464-aea929a9bb5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hcnymeg.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hcnymeg.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9dca8a0-fee1-4e97-81a6-51485b81500f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hcxy5.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hcxy5.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--431019d0-b77f-4339-aba3-a494b0952828",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hczvesm.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hczvesm.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2fc0838-7f39-441a-8f6c-40bb9b865a7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hd-21987aa.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hd-21987aa.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f47d95cc-3ae4-44e1-ac72-27c6bb126c6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hd-a168pa1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hd-a168pa1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdbd33ec-c2f3-4034-8416-a27e3ff9a98e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hd-daohang1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hd-daohang1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bc9151f-9578-4810-8196-2d9685bf50f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdjk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdjk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91693119-b0c2-4ca3-bfb1-0ad6466c65f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdoz-adguard.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdoz-adguard.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff80076e-fb04-46c9-8fc5-1a1d9ef4d074",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdporno93.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdporno93.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9a11b66-ea95-41da-94d0-a493114a3737",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdporno94.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdporno94.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72dddb2b-5ef4-4797-9b80-ec7022426f7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdporno95.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdporno95.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac8c2ef9-140a-463a-95d9-221436b6bf10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdporno96.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdporno96.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbb3219f-4504-4651-8041-ab91e4aede41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdporno97.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdporno97.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b595c2ad-5c4a-430a-91b3-f0fde817ecac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdturkifsa50.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdturkifsa50.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5954d26d-6a24-4787-8238-d0ecea9c35e8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdturkifsa51.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdturkifsa51.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d4d7737-9400-4972-848c-b825df988202",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdturkifsa52.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdturkifsa52.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9bbf1223-81c9-45cc-bb38-d6d1e00df2f6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdturkifsa53.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdturkifsa53.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a58891be-37b2-4dae-b2ea-ca58ffec7088",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hdturkifsa54.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hdturkifsa54.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4f5e426-a7d7-4c2e-afc5-8210fe1b07e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: he0.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'he0.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e128fc0-81a4-48d2-99e4-f79649fa79e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: healthcoveragepro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'healthcoveragepro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80dd3316-df77-41a9-904e-d6171cbe8390",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heartsmedical.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heartsmedical.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b91e3491-55d0-424e-b0c9-c7eb5d93e60d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hebhfbhef.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hebhfbhef.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15a05d94-9be6-4cba-900b-c84e60550d86",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hebupkisaje.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hebupkisaje.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f58c5e4c-c2ba-4f5c-83e6-b09096cd129c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hefofipazi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hefofipazi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a76cb1a1-2a4a-47ab-afba-19983eaedc32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heghse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heghse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a78ae20-53d2-4454-955c-e9f22906b2d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heii-lok.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heii-lok.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--697e1a58-feca-4d52-b09a-c3d27d6b6e0c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heimao18.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heimao18.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d808efc-7e06-40b8-b855-c62fe0f71776",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heimao19.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heimao19.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89a8bcea-9dac-4a89-a393-1b74105e92b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heimao20.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heimao20.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cbc08ef-e0ed-42e1-b73f-74a4a6ac3882",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: heinouswinesoatcake.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'heinouswinesoatcake.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85750956-1554-4110-9bc8-90e3811f1cad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hejooghb.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hejooghb.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30667722-50c6-4064-b892-57c5ee9b37f7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hello.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hello.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8c39d6e-a042-450b-832e-ba5d5b4054c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hepacxaneosolifo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hepacxaneosolifo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1d87451-f2c8-40cd-9980-a18c7532ea9f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hepunef.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hepunef.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aeb1c0b0-906e-45b4-bdf6-73067bbdade5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: herbi-link.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'herbi-link.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f77c4193-1ca4-4e27-bcde-84d582c90902",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hetatminovaekibi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hetatminovaekibi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b87d9d1-f030-4580-95e9-490567861d17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hewaney.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hewaney.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6e31cdc9-b6af-4f5c-a2d5-374ae098681e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hexapodbreech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hexapodbreech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40daba4a-65ae-4cb8-a2a2-0bc59411fe4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hexigponoikoda.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hexigponoikoda.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fca20062-85ec-482c-b720-09a294d4340d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hexsupply.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hexsupply.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89ffb606-38a5-4d19-8309-b8d926bc5a7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hf0nm.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hf0nm.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46e24cb6-78ae-4836-b3ec-6d94f17addbe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hfl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hfl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c8f0f3b-06e9-4b53-a099-38bdfd0a350f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hgdzhou.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hgdzhou.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c403a0b2-cfeb-43b0-ae2d-543e4684a79e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hgseklebkyeykle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hgseklebkyeykle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c4598a2-73da-428f-abcd-f203092ef53f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hgyqkfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hgyqkfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49fa0f04-b0b0-4e93-85c7-70f4f7133d2e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hhkcqy6.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hhkcqy6.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c8d1930-5c32-4fbd-bf2e-eaa1bd77916a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hiceg.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hiceg.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f275ad08-8381-420f-b59e-7b7c2ef5fa60",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hiledmoeovaja.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hiledmoeovaja.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fca5d65-7611-4067-b67e-2a7013892724",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hinly.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hinly.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--456a37f2-c8f5-4f6f-9770-9b887de8db77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hiqac.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hiqac.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b318779b-4728-4170-a27d-7929fa794cc2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hitajbolitoeomaza.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hitajbolitoeomaza.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--792898b6-9d95-49a3-ba2e-3fe6c4359aba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hizoru.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hizoru.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e14997c7-b1c3-470f-94ef-233939160abd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hjbbs.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hjbbs.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--954d11e6-01fa-4078-8345-9eff27c7bf5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hjbxvly.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hjbxvly.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dabd0216-8cd2-45c4-89c8-2cbb21a8f8b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hjqtnke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hjqtnke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2c1d2a4-a6dd-4e33-b508-9a5d556d1825",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hklovedj123.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hklovedj123.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aaeae656-8ccb-434e-b6b8-718bcc87feeb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hknew.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hknew.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea4a6b73-c1f9-4c7c-a8e3-5adfab76a3be",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hknew.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hknew.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed2282b2-0785-400b-ace8-49b003a461b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hknqzye.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hknqzye.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19ee9ddb-a006-4b6f-929d-157b2c82998f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hkreceive-home.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hkreceive-home.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40094942-6e90-45ab-b5fe-3a2ce06310ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hkreceive-pay-ai.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hkreceive-pay-ai.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2506811d-a06f-44dc-8228-ee4070631058",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hkreceivepayment-home.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hkreceivepayment-home.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7c50923-d1fd-4939-b4b5-35bf3f20eb07",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hlp.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hlp.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0e87631-638c-4f33-9641-5761c7b7e896",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hmcg.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hmcg.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5475a311-84c5-4916-9822-37b53c0f3957",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hmxpn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hmxpn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40f3f077-94c4-4c5f-b41b-39de1d04552a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hnaeoi.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hnaeoi.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bbedb374-5b76-4215-93a2-ac478071c683",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hnfxqgo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hnfxqgo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--376cb36b-aac1-47fb-b7ea-89db7f51a2d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ho57e.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ho57e.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55b67691-2669-4006-abdf-327814b831c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hoathinhhay.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hoathinhhay.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a068110-d6d4-4e05-a34f-c98c01ba8ea2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hobamej.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hobamej.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc4cad5a-6698-4ea4-80d1-c3ba1690cecc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hogasuj.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hogasuj.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f387336a-f592-41ec-8b52-87537760e3f0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hokirtpvegasslots.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hokirtpvegasslots.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5111a88-22c1-40bb-aa0d-66cf66b4092b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holigan-bet-kolay81.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holigan-bet-kolay81.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2c54ebb-e68d-4104-9c8f-2455c82b9deb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbet-amp-uye.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbet-amp-uye.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df7825b9-deba-4de7-8b67-1a44a7917532",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbet-girislertam2026.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbet-girislertam2026.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--899cc056-004f-403d-89cd-b18e638809a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbet-guvenli-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbet-guvenli-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5dc9d077-4611-47d2-8067-fe49f80c4262",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbet-holiganbet.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbet-holiganbet.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b304a0e0-6a51-406c-9a7c-8f7c3b44887b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbet-home1.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbet-home1.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a23a627-99e2-414b-891b-9ce90de7676c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbet-offical1.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbet-offical1.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd9bcbbd-23e2-4d65-a4a4-74c904056365",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbetc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbetc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a177be7e-3d11-4fc0-9a76-625553f81901",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbetsl.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbetsl.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44702a31-d1eb-4479-a5a3-c098ae3d0324",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holiganbt-player2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holiganbt-player2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b9a4f7f-e748-402d-afa6-00708ca9fdf4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: holisticvideopro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'holisticvideopro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cd44b6a-f26f-44e9-b6bc-837707fd954a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: home-hkreceive.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'home-hkreceive.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0acd62af-7728-4867-8d4d-eb049148f8fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: home-hkreceivepayment.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'home-hkreceivepayment.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0506280b-cb72-4806-b517-114119e33090",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: home-marketplace.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'home-marketplace.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f875572b-2a72-475f-b63c-490155719aa5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: home-payment.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'home-payment.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89714dfd-a9c1-4334-93a6-f8086704f633",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: home-paymentreceive.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'home-paymentreceive.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--737d83b0-a454-4039-98c4-835c8e2e9011",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: homeexness.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'homeexness.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b98ea59-b30e-4fc5-bab4-20ac700c6deb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: homeofficegovuk.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'homeofficegovuk.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--953b8552-ac91-422a-9fda-cbf8cd79c1ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hondatotoh0kii71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hondatotoh0kii71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--324754aa-39ef-462d-8096-2d6c843a4e85",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hondatotoh0kii72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hondatotoh0kii72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--600beb09-af9f-4e6b-8fbb-6bce3dc6f99e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: honestvideonavigators.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'honestvideonavigators.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--959e3958-86c4-4c1e-aa80-9b4646f9884b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: honeygrove.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'honeygrove.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48f0f7b8-5b80-4939-a727-9c0c9a8efcf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hooluye.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hooluye.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77a45846-4970-4772-86da-0d8266eed93e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hooriizmanorse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hooriizmanorse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab3c85f6-745f-4465-87ad-4bf8e0705956",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hopengbro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hopengbro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd0d689a-d36d-473d-b126-d6e4931f64c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: horiyon.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'horiyon.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56683127-0745-4319-a0b4-b8139aaf12a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hospitalbest.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hospitalbest.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2daf02cd-ee9e-4b14-b799-2b5142174d59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hostmailingactivity.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hostmailingactivity.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9ff641f-ee89-484a-a87c-298a5cf29b3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hotelaganorit.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hotelaganorit.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f91fd056-4767-467d-be43-335e3420b98f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: house-dragon-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'house-dragon-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97cbff44-c935-43f5-b722-051aca573752",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: house-drakona-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'house-drakona-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f43fa70d-b9fd-482a-b3dd-fa245fa50441",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: house-of-dragon-3sezon-3seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'house-of-dragon-3sezon-3seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82ccd1e5-279a-4e5e-a109-9dfcd2297ece",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hqg.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hqg.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0af120d8-5895-46e2-9c07-151a084a9949",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hqgjyfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hqgjyfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--021f97a2-8495-4204-a84e-76cf544ad877",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hqgmpfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hqgmpfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--620a6fe9-3606-4b12-a039-5a7425f361eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hqpkmja.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hqpkmja.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2131c927-52c8-4f46-b050-4ca5b456dac1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hqx.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hqx.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c3e6710-15de-4daf-8712-d1a1127930f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hqxmgte.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hqxmgte.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a626b9c1-7a16-4c7c-b785-3f15a5d7e235",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hreoirunfowedeftinh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hreoirunfowedeftinh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4dd09071-f9af-4d30-ba0b-2d535bf85ec0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hrw6zurf54.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hrw6zurf54.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d42d9cb-d2b4-45ba-a0ca-ac9f4e066389",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hs6br2v.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hs6br2v.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2317eb5c-a531-4531-b171-c241a76a8c96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hsyivsyiu.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hsyivsyiu.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3587f2cc-9fd9-4caa-9cb7-6d958d86441c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hu1zgle.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hu1zgle.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1801d60-a06e-4fb0-9950-d42267c69527",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: huangcan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'huangcan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ea3f717-7777-42a5-9a9f-6687592b2d29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hubbusiness.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hubbusiness.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57116c77-96a1-40be-a2bf-1d18d08abdea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hubspx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hubspx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebc5ba5f-499e-428b-8abb-6960fc6ebd04",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: humselo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'humselo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24fe01ed-59d7-428e-8473-2428c6aab871",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hunx-adguard.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hunx-adguard.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f74ceb7b-c28e-4cfb-85f7-25bd14feae88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hupgam.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hupgam.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--adcaadde-ce16-4d63-af1f-7b6faf19c7d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hurnexa.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hurnexa.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c88db858-fc2a-4413-a9a1-54f31d59ae3a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hv6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hv6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f3c58cd-78c2-4e1d-884c-5f362d2eeba6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hvacbeverlyhillsca.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hvacbeverlyhillsca.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--85c738a5-9b24-44b5-ab13-3f1fc67f828a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hw6.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hw6.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0865c22a-659a-478f-9596-7bd84a3b99aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hxasp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hxasp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21735523-5fdc-41cb-bb82-6468e4e4f9c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hxasp.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hxasp.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2415058-9146-43f5-8a63-4480f80a20b7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hxk8yvpuyzcv56fm6llwtmuyzc2wh9.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hxk8yvpuyzcv56fm6llwtmuyzc2wh9.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1643e9da-35c8-49b6-81fd-364ef863a56b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hxnvgpe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hxnvgpe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7097004b-3ccf-4ec7-87eb-7e2f24a86bcc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hxz09928gl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hxz09928gl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e8eea52-e304-4867-9eea-40e56f02a1d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hyperstition.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hyperstition.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e00ed37-f94a-42d5-b9ac-71a23ab76df0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hyucuivrevhindustry.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hyucuivrevhindustry.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93b22e71-ee65-4cf2-af07-f06728afb974",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: hzcnqya.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'hzcnqya.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--046dc28f-8548-4f9c-a79a-0c0af8d36490",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i2b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i2b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84842439-934f-4a68-b27e-ab2838676f88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i2m.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i2m.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c48e7daf-1935-4b7f-b7ac-3d3bbf849032",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i39v6.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i39v6.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9b11bff-1750-4ea3-81c9-9c33abc1b251",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i3e.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i3e.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd4eb1c3-2886-45e8-98fb-4f9db9d30270",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i3jd7jjdainfudiasdiid.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i3jd7jjdainfudiasdiid.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00908d93-6d9b-4254-9c99-654fd1392356",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i3s2hyh.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i3s2hyh.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--692d9abc-9ab8-44a1-900f-d9b17ad5ef93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i3w.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i3w.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3590a8f-06a8-4ac9-8471-91e30dc1d557",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i5h.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i5h.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d723cdb-83db-4d8b-a296-841952837ba1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i60qy82qkug.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i60qy82qkug.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96460993-abab-4eba-b46d-dfb8bd9919af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i697fwd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i697fwd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7332c99-0936-4d60-8996-36e025c59ce2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i6l0c73.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i6l0c73.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--342e7c7c-bf71-4ae2-b058-5098bbacaebe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i7x.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i7x.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77b0a890-6b16-4ab1-b15b-692d7222f19f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: i9aek.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'i9aek.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--306b2546-218f-4468-b686-eb86a7aa6fab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iacalibrage24.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iacalibrage24.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a95ef7a6-a093-4ddb-bd95-7fee6bcad332",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ialearning.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ialearning.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0370af21-162c-4199-9714-ae5ba9b5cbf3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iarawlss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iarawlss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5595d6ba-853b-48fd-bbe5-4072549b963e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ib6raqf.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ib6raqf.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34593f12-7853-4bc7-9088-8054b86a74aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ibgseguro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ibgseguro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62bde3c6-7e98-409c-938d-8fd51a76c877",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ibizabet-klassgir.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ibizabet-klassgir.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--368797aa-851c-4ed9-913a-479e6f2e8d7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ic989.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ic989.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f51bc88b-23d5-40e2-8f8f-c87fbb147300",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iceredwinuk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iceredwinuk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--05373c40-0a99-4627-b11c-09a65da04801",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: id18392.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'id18392.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c577de7-f132-45f3-b304-646648448b7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: id3240865.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'id3240865.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12eb79ae-c1f3-4ce9-9560-c3de6eba60e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: id3240865.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'id3240865.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b7c8e69-ccb9-4b0d-b717-d09a90560111",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: id3240865.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'id3240865.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c65b5c9-546f-4d06-a988-72270229844c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: id789042.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'id789042.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--afae9e5d-c166-442a-bc51-ea31bdb34861",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: idcash877ppxx.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'idcash877ppxx.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8de4ae16-7017-4cd6-a9d4-8c488bb5f380",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ideabc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ideabc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--768727d9-c9b9-4eb5-88c8-bfe68926681f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: idvlwq.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'idvlwq.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07591d21-6c22-4e8c-a0d7-f7f863478595",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: idvos.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'idvos.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89c44f47-e3c0-43be-9798-bd2e35e4228b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: idx047292.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'idx047292.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c009f2f-be96-4844-a8a2-80d3433a4a53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ifje1q4am8hcy91.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ifje1q4am8hcy91.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7ac8ba9-41a4-4bb2-b923-5657ea03dc9e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iflyz.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iflyz.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc31ca0b-61a8-4cbc-9f76-857f58dc375b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ig2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ig2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0086e092-1583-4725-b768-809af4cee2a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: igadeptula.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'igadeptula.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--820f8236-3e6c-43fb-a764-589a03e03548",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: igapich.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'igapich.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1bebe6c-d203-4b6f-8705-87dde74c2d6a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ighto.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ighto.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ffa01411-e4a2-46eb-8382-6b348cd17069",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: igorwilczacka.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'igorwilczacka.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7473dd32-9ea6-42a4-b548-b786aa0abe12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ii2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ii2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55f48082-7b7a-4c1c-91fe-79c5691486ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iicss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iicss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a456ff69-770b-4ca8-b955-64760101e286",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iingfc.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iingfc.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27260c21-95d2-4ed6-93c1-a4716d293b82",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iivods.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iivods.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a3813381-0054-42e7-a048-c2249d457202",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ik5hnor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ik5hnor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25fec3cc-2b7c-4c21-ab71-ef461a619330",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ikimisli-link-resmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ikimisli-link-resmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d734afc5-c9b5-40f1-bc10-68863f796511",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ikinmargarita.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ikinmargarita.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1fdd36d-5343-4941-b5cd-ddff7c4dfadc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ilgelatonearezzo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ilgelatonearezzo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--000f7fc7-bb71-46ea-bce4-0249c13ba168",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ilonservice13.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ilonservice13.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c394c866-54fe-4c12-8b17-cfa660e91872",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ilovesxm.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ilovesxm.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0131067-5290-4aa1-ba95-0857816c63d3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iltsqsnk.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iltsqsnk.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f60166ef-06b6-4f91-b5ec-d04f015afe02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ilxpzsiwems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ilxpzsiwems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03bec256-c255-49ec-a261-ad80dd0c49a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imajbet-player2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imajbet-player2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6c89b09-f9e5-4af4-aa29-4f2506b6c758",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imajbetguncell.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imajbetguncell.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b1fafd2-85f9-4313-8dd2-6fa6c21e6d37",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iman-soli.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iman-soli.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48b3bc3a-61e0-4680-881e-9ae3c02a23ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imoh-protect.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imoh-protect.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18e11a3f-5e2b-424d-9137-aa4d44732a48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: impentscavel.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'impentscavel.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7dce49dc-08db-4053-8eb8-4bfa833ad576",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperativeexec.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperativeexec.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0948356f-8603-455e-b65a-930cbfa6cc4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperator-sokrov-13seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperator-sokrov-13seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--245bcae8-c725-4090-8ce8-0776df4d2e97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperatora-13seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperatora-13seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8d519a8-3527-40ee-8c49-febd96db3919",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperatora-3sezon-13seria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperatora-3sezon-13seria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9632caa-a047-4a69-bc35-936a780fd15d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperatora-klad-final.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperatora-klad-final.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a9ec90be-dcf7-4c38-8717-2accbcc3e32e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperatora-sokrovisha-13seriya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperatora-sokrovisha-13seriya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59794bfa-ed50-41c2-96d7-f05e89648730",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperatorov-sokrovisha-final.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperatorov-sokrovisha-final.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60c1353f-8357-47b5-be46-eb944800a16e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imperatorskiy-final-3sezon.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imperatorskiy-final-3sezon.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c707b51d-80cb-4d46-8d83-37507e034ac3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: imtihanat.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'imtihanat.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77d8506e-12c2-44e1-9635-59d1f267b02d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: inaeiss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'inaeiss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f1a9484f-5cc1-4c4f-9f62-5aec0ede6346",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: inboxflow.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'inboxflow.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79337680-8d22-45e6-a6c9-556773cc6dbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: inboxx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'inboxx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d692ffba-f711-4b65-b7b2-86119832fc05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: incapmeniv.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'incapmeniv.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--70aab5e6-af85-4039-a314-869de77fd0a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: incorresto.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'incorresto.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56b73bb6-66f9-4683-8d73-5458b136f1c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: indiantrails.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'indiantrails.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bcfeedce-7ae2-4d51-bf9d-7474773e4168",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: infiniport.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'infiniport.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7bf862c5-5637-4fda-ac0c-fa9a3bd9efc0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: infiniq.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'infiniq.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--405f90c0-9218-449b-9660-57ba0a8fb1af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: info-ld21243.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'info-ld21243.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a1298ee3-d46e-4fe5-9a1d-440d46e64000",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: infocore.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'infocore.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6f6c20bc-0217-4610-8518-f6d6b6423bbe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: inganindeg.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'inganindeg.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef4ae920-6e19-4cc4-b38c-f521bc88b619",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initiate-betboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initiate-betboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--809fc27c-ebc4-426d-b1ef-36b13829b5ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initiate-boost-winonline.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initiate-boost-winonline.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ebf0b30-d7c7-48a2-84b2-d147fb672868",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initiate-boostbonuskz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initiate-boostbonuskz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e9bdebb-9d70-4b74-8103-92667836372a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initiate-boostwincasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initiate-boostwincasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21a0b11a-4584-4e68-b2ea-3af69db38079",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initiate-kz-boostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initiate-kz-boostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf0fd7d7-1a91-4ace-a1ae-f270d5e34db4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initiate-kzboostwin.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initiate-kzboostwin.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1535dc39-ff86-491c-af32-1d574409edb8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: initoko4d.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'initoko4d.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ff7d754-4273-460b-8b80-c99f5ad30f77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: innerleadfounder.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'innerleadfounder.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eaee36fe-b747-4cbe-b235-6dab9529cb66",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: innerpeacementoring.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'innerpeacementoring.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f6d3ec7-a255-4049-af40-8dd3222e6673",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: innerwisdomcoaching.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'innerwisdomcoaching.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c87b9e1-14ed-41f0-8efa-203b86217589",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: innovacctpro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'innovacctpro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d2d6048-f0ae-4911-b4b6-e26c7e26638c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: innovatevisionvideo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'innovatevisionvideo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19de6f92-fb1b-4376-bd2e-e0a5d700a0bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: innovationaivantage.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'innovationaivantage.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43809a6c-9218-45a6-a26e-42d0ee6d0ff0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: insideskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'insideskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bbff8f0-1e30-4ecc-937c-5fb81ac89073",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: insightaiconnect.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'insightaiconnect.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5b3e2b3-2557-45af-883b-f27cd879e800",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: insightbookmaster.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'insightbookmaster.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c603bb0-f353-40ab-adaa-7dcd44b8faf2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: inspirationalcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'inspirationalcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--abc437e8-bb5d-4da1-93d4-48ed0e5cf2d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: inspiringcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'inspiringcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fd5be3c0-d107-4cd6-8188-a3d5c10be813",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: instaforex-uz.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'instaforex-uz.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4b49e063-ae7a-4655-a9b2-f802c241f992",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: instantcourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'instantcourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96f817e1-a691-4e23-943f-7a0af6af5f55",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: instantrowth.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'instantrowth.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b83e74cd-0e66-4988-aa9f-03c3bf27af41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: instanttaxadvice.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'instanttaxadvice.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5a6f61d-2c69-4a06-9f1c-431592a78be7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: integrityaivault.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'integrityaivault.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b288d7e-92ed-48da-8570-af1e673976c2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: integritysound.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'integritysound.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f72d0181-4d86-4303-bc9f-1edbdaead4f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: integrityspiritualcoach.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'integrityspiritualcoach.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--106a6af7-f240-4009-90bf-14fc6dc1be6c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: intelligentcoursenetwork.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'intelligentcoursenetwork.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--791c131b-bde5-4ef9-ad2d-5ef28a98a794",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: intelspell.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'intelspell.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4ae7dd5-2070-4170-a3d0-9bdf0929821d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: interactivecourse.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'interactivecourse.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aaa5eedc-0065-4d10-92c5-15c9f4c43fef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: interconnect.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'interconnect.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ff3635a1-4f2e-4cb2-a93a-dafbb39e57a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: interiordesigner.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'interiordesigner.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b060ba46-b1ed-4c86-9cae-08b2aeec8ece",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: internal-brief.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'internal-brief.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d9b6da26-2e41-4d0c-ab66-5bc76e8f889e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: internationalterms.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'internationalterms.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61066f68-6c05-431d-9239-32e5255d1936",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: interny-tv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'interny-tv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--859b0a0d-7cce-45f4-9c0f-17be03f353e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: intuitiveguidancepath.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'intuitiveguidancepath.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f09e7cd7-2c84-4a43-aa49-ccd1a91e48bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: investstrategyco.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'investstrategyco.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6b8e205-8f98-459b-857f-1987ebbc3802",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: invinciblevideoexpert.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'invinciblevideoexpert.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8a099a5-c1a7-4f50-bde4-e2897986f6fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: invokercc.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'invokercc.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--604d88f9-0a96-404e-b40a-5313b04e6d79",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iokwk.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iokwk.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9815b4c1-0704-43ef-a28f-c05e0fe16ed0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ioxss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ioxss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b92628d0-c063-4d49-93ba-16f3aff66fbc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ip0mqde.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ip0mqde.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d15ce8f-92ed-4d37-9237-be09489681fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ip5.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ip5.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6dd29e04-410e-4758-aa3c-095e8200e956",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ipdro.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ipdro.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27bbf84f-3237-4e14-b290-dde7a5058b80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ipk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ipk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0023b437-9615-420d-bf7f-3c910d3b02c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iplcmengxiang.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iplcmengxiang.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--016fc42a-034f-4945-8a9d-fa97f4e6726a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iq-chicken.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iq-chicken.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b7297037-7f40-4e46-acc7-3cb107f54eda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iq-goldenplayers.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iq-goldenplayers.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c56fffcb-ec41-435a-a1e9-4ff5058089e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iqy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iqy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e1e4de7-291c-4119-8385-02e9de7546c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ir077.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ir077.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3bb6b26b-c778-413d-b199-52e04f96999b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ir4loj4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ir4loj4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5439b6d4-8ec2-4ce4-a5ee-3161d40c7526",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iranhostpardis.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iranhostpardis.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9f4ada0-80f6-42a7-8263-5a4fcd12b0a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: irgct.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'irgct.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35aed6fe-56b8-4ac9-b572-add268bbac98",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: irisinunquitensues.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'irisinunquitensues.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13252d4f-d17c-4ff3-8634-11ca2790431e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: irrorsemic.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'irrorsemic.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--075e0af0-7771-46a3-a1de-a0f5a2564d41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: isisanteknik.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'isisanteknik.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1879738e-316b-4680-b90d-b96da25ec630",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ispaniya-portugal-futbol.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ispaniya-portugal-futbol.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19abba87-4670-41b2-b07f-a065134f4712",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ispravlenie-i-nakazanie-kinozal.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ispravlenie-i-nakazanie-kinozal.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e36c0ecb-61b7-483e-a4bd-dc3247083b54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: israelpoast.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'israelpoast.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f44ad6d5-cccf-408b-87d7-7cca03ef28c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: israelpoast.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'israelpoast.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09aaecde-5535-4b78-8e3e-bf7b01d6fb3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: isrwelpgtvd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'isrwelpgtvd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43159506-764c-49df-b101-f453338ff233",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: issus.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'issus.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--511a1ea5-6c71-414c-ab58-082886649e31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: issus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'issus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4b8e785-11fc-467a-b5ad-74f361947175",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: istoriya-ego-sluzhanki-seriya.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'istoriya-ego-sluzhanki-seriya.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06a081bd-c454-432b-b070-72b69daac4e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: isvtumpost.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'isvtumpost.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b241347-bf44-4678-a9ee-62788e510b02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: it1mgqjlx7wq2ag.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'it1mgqjlx7wq2ag.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac872ce7-13ac-4588-9c02-f45e15759327",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: itcompanylegal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'itcompanylegal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5ec930a-421f-49d9-a106-c21998ec4183",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: itengineerlearn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'itengineerlearn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--886d1eee-b967-4933-93c9-bcfadf412d1f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: itscominghome.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'itscominghome.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4b2cdd3-5e65-45d1-b296-b2fea4036519",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: itsecurityliter.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'itsecurityliter.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae06b6c3-38dc-4bfc-82c5-95523d539ac5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: itsybelle.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'itsybelle.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21b50184-8c48-4a42-9aec-7d1687b73413",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: itxpzsiwems.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'itxpzsiwems.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c536c5f3-d686-4880-bb68-eff87e4885df",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iu724.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iu724.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac2ce69b-e782-47ec-916c-38e527066672",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iuhwi22k-cm3jq222h2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iuhwi22k-cm3jq222h2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7da96c0-a0e9-4afe-a23c-6f06a5fe29f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iur44.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iur44.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64d1ab0b-af86-4024-a46c-b9da8bf808cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ivanovy-ivanovy-hd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ivanovy-ivanovy-hd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1725732d-6dc4-46cc-a64b-eac70948c1ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ivarnemorix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ivarnemorix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55fec027-244d-4583-b013-6cc6b19a9bdb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ivi-smotrim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ivi-smotrim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21c9490b-019b-415c-bd80-5f7092a843cf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ivmnt9k.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ivmnt9k.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1255f26-c6a1-440d-8062-535c83b884e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ivyharvest.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ivyharvest.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b282e6d2-9bcf-43d2-a3c1-bbb425ca157e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iwdvxu.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iwdvxu.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab7b0fc8-f258-4d18-9643-09aced0fd533",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ixa821kndas7j3b27fdf3.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ixa821kndas7j3b27fdf3.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdab174b-19f3-4d6b-9b42-ad345de1c7a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: iyq8qka8e8i.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'iyq8qka8e8i.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61e4b3de-75ff-438a-a23d-ba9d3ac8c3d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: izabellawojtyla.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'izabellawojtyla.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d8c713d-bafd-4a93-a365-b1a881ef87af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: izebet.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'izebet.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17641e07-2830-4f5a-ab39-3cba542618ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: izmeny-kino.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'izmeny-kino.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3496f304-2a04-44bb-803b-836015e9397b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: izvne-vse-serii.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'izvne-vse-serii.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b042b18-086c-4459-bc24-b76993139e70",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j19mshu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j19mshu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e10d18a5-c765-4a65-81d2-405c52acbc4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j1k.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j1k.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c606905f-7eda-4997-ada0-e11b561f1d38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j1s.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j1s.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbbf4d3b-b03c-4cee-9b5b-23195ee868bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j2gy34o.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j2gy34o.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2f0e1de-dde3-4d2b-9905-5104a4bfd6af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j33uilz57r3q3o832nzyfw.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j33uilz57r3q3o832nzyfw.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cb0eee1-b381-4b6e-a89d-3a82f943c0f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j36.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j36.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1a85cb89-7600-437e-b1d3-739e61376720",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j38.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j38.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b0c1529-e7c4-483a-afaa-3491e5c0205c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j4b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j4b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f5c3ca64-a025-4756-a97b-80b10a3c8a16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j59.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j59.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56593e57-645f-4fae-9602-64d4e7f79ad7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j5t.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j5t.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ae506eb-b28e-45d7-8890-fcf45f4d4033",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j6d.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j6d.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec3cb3fc-c944-4a70-8b5c-9b53a4f80cfa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j6p.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j6p.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--329aa345-7bc7-4121-b787-ca982ff49844",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j6uvpbr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j6uvpbr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--395fab17-ae77-4bc0-a726-dc48ef706edd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j80.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j80.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59567f5a-df84-4184-9588-e31084004c15",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: j8j1zi59ax183sx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'j8j1zi59ax183sx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6652f84b-51e1-4180-ba65-515a6aae5438",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jabonxavioraoceso.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jabonxavioraoceso.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b64c6349-eeb1-476e-b462-be9ba3605e78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jabutiess.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jabutiess.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--09d68be4-5105-4d3a-9875-0224a7c42710",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jacipss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jacipss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cc79f63-1bfa-43cc-a40b-1dc677ef4cc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jadez.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jadez.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88d1f1d8-04b6-42f6-ae00-7ea8c34a6a90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jagoledak2qvc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jagoledak2qvc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--065cb0b7-6741-4415-b93e-99199ef96686",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jahemurahseger.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jahemurahseger.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--051d4366-4213-4583-a8a7-71a0dfb78d24",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jaiho.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jaiho.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--433e0f1e-0f51-4aa5-93f0-597cb17e2302",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jajepuf.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jajepuf.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61e5a885-08cc-473f-bd76-782b4337d788",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jajogiv.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jajogiv.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ced2f85-bfc2-4d1a-affc-a4d0af922503",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jakubkurpios.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jakubkurpios.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f060b3c6-b426-4f21-b3ca-e549a5c971d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jalanuntung.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jalanuntung.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b63dc19b-ea93-4fce-b9e7-1c6df7fdf9f3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jamenpekotado.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jamenpekotado.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76411754-1c5e-42a7-b748-3d9cd93e01d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jamesnuotherwise30.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jamesnuotherwise30.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56b71581-02f6-46c9-a613-fa81fbe5cde2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jamop.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jamop.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe7e60f0-4013-4a26-9da3-c951b201deec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jamur4d.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jamur4d.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76425d34-c840-44df-8750-e17f8dcbb71c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jantor.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jantor.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4723a770-d4e8-4155-a5fc-42e87eda1978",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: januszkuncman.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'januszkuncman.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8f2625ae-c545-401b-85e1-7dfff55cc2a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jasmin-bet-guvenli70.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jasmin-bet-guvenli70.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f882821-127a-4b38-a14b-686bf77ca513",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jasmin-bet-resmi22.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jasmin-bet-resmi22.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6c8d923-e62b-43ba-9db2-602bbe2bdd43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jasminefield.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jasminefield.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3a0c66e3-88e1-4c62-91b6-e257f5c56b05",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jasonolivertam.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jasonolivertam.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8630a0c3-d9b1-43ae-978f-8d89fc6959bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jateproxeaxata.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jateproxeaxata.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b33426d3-aefd-4093-ba79-ee2a43e0881c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jatilgiloeleva.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jatilgiloeleva.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c29c47e-297e-4561-ab8c-1fceacec473b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jatobanss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jatobanss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6fa50078-65bf-45f2-bdbe-f5f304f68d01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: javdrive.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'javdrive.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7fc59cf5-d4f8-4cbb-b85e-3941e6a79390",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: javmmtop.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'javmmtop.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6534a9c8-b428-4c6b-bdcf-4da722b3048c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jaycegomail.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jaycegomail.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be6678ea-f988-4989-a7f4-7f445ff41f22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jazigew.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jazigew.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--98b18494-1b91-4204-a161-24df1c428b02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jb7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jb7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93561fa8-e810-4b72-83f2-e94361355921",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jbliv.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jbliv.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a55c40eb-7827-4797-a048-08cbb8446689",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jcmqzvn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jcmqzvn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--518f209c-5a6d-40bc-bc49-8b4a9500d1bc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jdx46kh.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jdx46kh.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c6cd30f-d527-470a-b9b7-b4543a2f6b36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jebexnagiloofoli.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jebexnagiloofoli.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--176add02-cc43-4f0e-a18f-b6eecba0b180",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jebohhearehasa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jebohhearehasa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c18ee96-056d-4bdd-b935-9c10b30a2827",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jecayok.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jecayok.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cfc3aa80-311c-4cdb-b97b-0a44b90d84e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jecetcelibozime.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jecetcelibozime.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b373dd3b-e963-407b-98b1-3c40168e252a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jeed24c.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jeed24c.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4bde80f4-dd58-49e4-bbb9-5da48c95ee43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jehad.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jehad.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--370d5908-0633-4242-a817-7267ddb6f773",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jelocxajikepo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jelocxajikepo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--350db9d6-51d9-4053-90a2-272334c30f39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jelozex.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jelozex.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22a4c1e2-7639-4828-9f3c-30038d84c34a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jemipevabi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jemipevabi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c256478e-6a8e-48ce-8284-38d1c8d20f48",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jensonvpn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jensonvpn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6fcf6f88-1cd5-4019-b82b-e0ed8c16a960",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jequitibaswss.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jequitibaswss.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--092d2cf8-1be6-4532-84ec-ca0f805a0326",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jetbahis-casino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jetbahis-casino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--418897b3-7965-4292-99e2-617f13ef07ca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jetbet-casino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jetbet-casino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--18019550-70d0-4053-88b1-5b305c8f6e28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jetbet-club.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jetbet-club.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cf7f50c-06d2-48b3-a12e-95239597dd0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jevusid.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jevusid.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58b45b39-47eb-466d-a4e2-897ed6af7a78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jezemxeosomina.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jezemxeosomina.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45c68ec1-30f7-4830-b6f3-c42d0eeb778d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jgh.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jgh.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c744ddd-8702-47c2-be96-26c50178e8c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jgnwyfa.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jgnwyfa.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3fb062e5-79bf-4d2b-8e74-fdcaa602a701",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jgqpkya.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jgqpkya.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--086a2926-3e18-4895-af48-fe9ed7447997",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jhctwke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jhctwke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdee8784-e3df-4697-8cc1-aaba576dc389",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jikss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jikss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6bdbd6b6-221d-46c3-82c4-6631e7a3ba72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jinglang51.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jinglang51.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--58debcdd-b745-4c9e-9ed0-7c6318df8cdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jinsu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jinsu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0af87a8a-37c2-41d6-9e66-17e70c99084e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jisub54.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jisub54.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--088e54ed-029d-4a14-9eaa-5dff9ab1aa31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jisub55.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jisub55.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67fa08c2-e289-4252-9f24-e314b3e882c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jisub56.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jisub56.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87c5a88a-1719-4b4a-ae0c-1911f7e2d246",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jiwagim.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jiwagim.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0c544a9-8f75-41a3-8009-a11364a791f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jkesl4v.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jkesl4v.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00f24d3c-8cf6-46cb-918f-e8aac656b5ab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jkill.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jkill.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--125031aa-35d4-49b4-91e9-816694a225c6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jknxcoa.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jknxcoa.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7e406c7a-0da1-473f-a122-2c52294f1767",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jktonkcdo.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jktonkcdo.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c70a08d-0b35-4615-aad0-7f0964b39d88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jkzxt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jkzxt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27a0b9d4-362a-4568-8fe9-89a855d5f932",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jlcwkfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jlcwkfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9bb9dc48-e504-4cbb-8974-87f978d6e3f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jm4e28yzzbluhqg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jm4e28yzzbluhqg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76729532-a840-4fe7-8b09-029ca35545f5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jnhjkj.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jnhjkj.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17f5621b-8207-4323-a7dd-bc6178bfd062",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jo-qbo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jo-qbo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c865c316-c57d-4159-a305-2118f125f890",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joanmarieguidedmeditation.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joanmarieguidedmeditation.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69f2dd0d-1c36-438a-8a00-b0d758764750",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joannadolik.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joannadolik.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3dad3047-3d16-4593-8af7-0887159717ce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joazur.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joazur.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--869e3c9a-f3c8-4849-88da-122b011d7871",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: johngalt-1.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'johngalt-1.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--afbcf29e-6675-43df-8247-7e6e8d6cd499",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: johngalt-2.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'johngalt-2.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef3d51c0-6df9-4aed-8818-6682f8ac2467",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: johngaltanalsis.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'johngaltanalsis.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c4b0c4dc-55a5-482d-8c81-d8faf224bc3c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: johngaltreviews.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'johngaltreviews.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--73bbdf2a-41a4-4bf5-9fbe-8e86420afcd3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojo-bet-link-resmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojo-bet-link-resmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4457934b-36d4-40f4-8f15-34860a0f5a01",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-adres.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-adres.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b59bbae4-faf1-4d32-8241-b8b99f67899e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-aktifadres.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-aktifadres.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8417f04d-1405-4d19-bf93-7bf974cb0e63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-bet.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-bet.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c98f19a-d9c9-4b71-9b36-a812f97c4fef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-girisi917.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-girisi917.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c722c078-8cd5-4f1a-bf3f-ac49bae877b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-girisnow214.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-girisnow214.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1709ee9-0c1e-407f-ad0c-38da6815da8e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-girisyap.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-girisyap.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23779e2c-f40c-42d9-b6a4-4357dea86c58",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-guncelgiris270.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-guncelgiris270.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc37aab6-b821-48cd-83bb-b640db924f97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-mobil-tr.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-mobil-tr.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51d060b6-4a63-4458-a227-7433d7051862",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-mobilgirisadresi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-mobilgirisadresi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea4bdaf3-eb58-4d9f-b6b4-76f4462aad5e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-player2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-player2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--908dc426-b018-4d46-ad57-8be2b53dd5c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-resmiadres984.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-resmiadres984.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2ebf64dc-5394-4e94-9a56-032c8353375f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-seo-adres.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-seo-adres.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c70d1e2b-355d-4164-b336-a413ade167c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-seo-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-seo-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea67eef3-3805-45b6-aa56-f4e567c9a29e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-seo-guncel.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-seo-guncel.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23d05cd4-46cf-4dc3-855b-85b2f4ebbc57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-seo-mobil.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-seo-mobil.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d2d7b5d-88c5-4e6a-b50d-6c7ddba9687e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-seo-resmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-seo-resmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63c8cf28-e4b2-4855-a6e3-7e2da58f52a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-slotcasino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-slotcasino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c089d8a-6a33-4ed6-a670-7d8096340775",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobet-yeniadres228.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobet-yeniadres228.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--591a3871-b06b-4111-962c-22521b134502",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetamp-kayit.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetamp-kayit.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3205211a-21e4-40d3-94b1-19f500b9a450",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetampkayiti.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetampkayiti.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a09bf779-2bd7-4c8b-afec-01e422a77f90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8d2d6fa-f34f-4b3d-b381-dda15b4c5ee8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetcasino865.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetcasino865.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ba47f28-8446-4e19-9b3c-cd1511e49cbf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetclub.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetclub.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac23fb5f-758e-4dc4-aba6-6c4371bbf2ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetgir.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetgir.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf9647a4-3fe1-419c-886d-341f4155a46b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetgirisic.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetgirisic.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b08b498e-0d16-4b5c-9a7f-fe2a7005b503",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetgirs588.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetgirs588.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b95914d9-e476-4644-bced-4cf030d6d20b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetguncelresmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetguncelresmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1cef47dd-8615-47b9-b2f1-b5bcbcd07528",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetlive125.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetlive125.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3cc67252-908b-4ff0-b38e-eabe2701353f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetpro806.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetpro806.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--427b7179-394d-4331-a6fe-be77df763f53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetsl.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetsl.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--debd7723-fce8-4d41-9d78-2069617d2688",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetst.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetst.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3856d90-385e-4212-9b02-37151822ccd5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobettc.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobettc.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--217cd323-3306-44d8-b0e3-4386069131d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojobetyeni181.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojobetyeni181.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22cf85f5-256c-4687-b055-836189112447",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jojotext.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jojotext.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ae7feede-aa3b-472a-b822-f969b932d354",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joker-bet-gercek55.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joker-bet-gercek55.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1035e8a-b607-445c-bbd2-9830b1c88bb1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jokerbet-resmi-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jokerbet-resmi-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--907ec5bf-e6dd-44bb-a388-14e15c65304f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jokerlu-wsc.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jokerlu-wsc.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97dd63f9-7a90-41ab-a5fb-c2f85f5e48b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jolantamachnik.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jolantamachnik.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4082aa3d-a49d-4edc-96ad-e384a8fdba8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jolnexu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jolnexu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b187c91f-9fdf-43a1-96b4-12509cf3e1bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jombalsejiomalercf.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jombalsejiomalercf.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c429c195-8bca-45df-be65-55c1e6f5474b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jonstream.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jonstream.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f56d2ccd-7ea6-4d3c-9840-fd504a27d924",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jopolex.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jopolex.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--deec5eb8-11cf-4cc2-9745-e8a45bf9bde7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jopoxaw.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jopoxaw.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cadb992-87b6-4fe4-ad76-538af933b56d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jorelvqenai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jorelvqenai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00eb2a67-2bb0-46f0-8392-614ae75e2a3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jorntan.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jorntan.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec2ffe4a-900d-4fcd-9717-36125ba29be2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jostotoxi71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jostotoxi71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--852ac09c-6a85-4459-9700-a22c18f468ae",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jostotoxi72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jostotoxi72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04918c77-a6aa-4e16-b668-15ff75599860",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joxoloposi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joxoloposi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--237e098b-82c5-4838-95b0-7e60e811adb3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-bonus.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-bonus.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12a53f5f-438e-4356-99c2-0833b0ae8a8c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-club.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-club.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3dcace46-06d9-472f-aa92-fda85b365f27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-open.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-open.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7926741-a8fe-4e94-9daa-5c58b14c52fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-open.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-open.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--045ba422-caaa-4125-a36c-0c4a2c72833c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-promo.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-promo.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3529d307-a04f-4f88-9d52-5374ba3aebe3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-slot.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-slot.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42cf77d5-0ad5-4976-9595-b6285ec6847c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino-website.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino-website.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bb07303-e3ee-45f9-93f8-6e0cc909fe7c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasino2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasino2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b4c93c6-35c5-4806-9631-de8cb8960a4e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joycasinomirror.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joycasinomirror.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f02d5fda-f467-4f6a-9369-f7b7a1c84265",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joyslot-88a.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joyslot-88a.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--84677bdb-1ed0-42b1-b889-3eb09440c658",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: joywave.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'joywave.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ad918ff1-8605-4341-a3f1-6f0977107361",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jozefbiskup.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jozefbiskup.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc2e72d9-2e65-4b60-912b-99294fdc041a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jozefzachlod.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jozefzachlod.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e85e11a-1bee-47e8-8c46-59ff6f6fe3a0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jp-jp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jp-jp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c6195ba-a39b-4d22-a8d2-16eb6f4b6edc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jp6nxn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jp6nxn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57d13f78-4d83-4dcd-a733-126dc51cc23a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jptqvky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jptqvky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44516d76-5db5-4881-9b06-ee5314a67264",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jq2.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jq2.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a3c30a4-a99c-41af-bec2-064a90afc00b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jsth45852jmtz1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jsth45852jmtz1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fbf80b48-30ad-46a3-ba97-8ee9a4adb854",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jsxav.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jsxav.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e57558e7-08d9-45db-83c0-41ed354165b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jt2oua.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jt2oua.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--843295fa-d241-48a3-a268-e895e3caf906",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jtexpress-sg.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jtexpress-sg.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c41e4c42-441b-4717-8995-142e8c8ae024",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jubogow.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jubogow.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7181ba0c-8372-460b-a086-3174d937c616",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: judeju.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'judeju.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1c32854-c6a7-47f6-948a-68667fe67bde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: julolam.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'julolam.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4137685e-a621-4ec7-9221-bc8e817ec57c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jurinyati.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jurinyati.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbe2fcfa-cba8-42e6-bc6a-d198af2c517e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justboostlab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justboostlab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1393078-620c-4882-a620-6d4b119e664b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justboostset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justboostset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d24d7a90-7a7d-4361-bd9c-8c6305b7bcda",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justbwnpelc.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justbwnpelc.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a534618d-ef0f-4ef0-b10e-63bf2a05bfc4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justcapital.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justcapital.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc3a4ba2-716a-408a-b493-7feb1607c610",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justdobetterconsulting.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justdobetterconsulting.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e026ad56-4cf5-4dc9-818a-c60eff3f45b4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justelcanai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justelcanai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1a48a01-8a71-41f5-b335-68cd2757cb96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justewhubsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justewhubsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c159de3d-f150-42a1-aa08-de6c0a64eb02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justfunneapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justfunneapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c1529ccc-257d-495b-b820-ea38419768d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justioe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justioe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5814c7d-e977-4b65-9b8f-99301cb67ca4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justnflowsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justnflowsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d68309ea-ffe3-40a9-88a9-283eed7b874b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justnsyncapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justnsyncapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--729b8f20-370d-487c-8e75-b1e909a75d2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justnsyncify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justnsyncify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed497675-365c-4c59-9252-00f83b2fbaf0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justsmart.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justsmart.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56a90127-805c-4fa3-8b87-3de85d7ff7d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justsmartly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justsmartly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2251b6ab-dbe3-43ba-bcd8-78237d9fdc0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justvibes.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justvibes.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24ecb038-0c28-421c-8186-ec8b3cf9f0d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justviralbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justviralbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5aa4f930-45f9-4489-b1d7-4558cc37a892",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: justynatorlop.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'justynatorlop.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dae1cd97-e90c-49a0-9fdc-502a1d722066",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: juxeleh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'juxeleh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c7f4c5a-144d-488a-abdc-1c25104f62a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: juxmns.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'juxmns.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8db38993-b62c-4967-89c7-071873b01c10",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jvu.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jvu.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3faeb68e-0076-4711-b1da-8741f20764e3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jwd.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jwd.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23e248c3-57f1-4d21-bbd5-1479dd7d69bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jysk-qualitypoland.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jysk-qualitypoland.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3399d88-c3fc-4dea-b29c-f2008683bdd8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: jzh3s5c.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'jzh3s5c.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68de5e2b-0748-4ef8-85be-f6508c6d1502",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k01pf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k01pf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fbf8b4a4-8b63-478f-b963-409e6a78d105",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k0o.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k0o.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a910ce65-c750-46ef-9aa4-5734322bbe3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k0v.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k0v.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--025f714e-5248-4f93-b56d-2eab8bc7d202",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k2h.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k2h.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01ca1ccb-98cb-4740-b2bd-e87320fc623d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k4i.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k4i.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0221f5d4-c6a9-42c6-a829-a9bca1ce66b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k4l7n3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k4l7n3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a28dd46-132b-46f4-a3b2-092e94f67e64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k4v.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k4v.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7c3e114-947a-4234-88ae-3f5937e56cd1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k55b9v.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k55b9v.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3a911fb-da06-4e6e-af19-0c82225b0b98",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k5z.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k5z.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--19aefc65-676f-4288-996a-3d34b0c0e282",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k9b.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k9b.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce64cf3a-a2a2-418d-9c11-39e754f7d3eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: k9i.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'k9i.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3123f0ca-2fe9-4bdd-883d-008e19ac40b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kabad.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kabad.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df42e9e2-a90a-411d-80f2-5420b08cc73b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kabutogskm.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kabutogskm.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dc457ed4-723c-4305-ab19-78f0bd74744b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kacperczapla.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kacperczapla.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3f63412c-d730-4ebb-898d-11b881cffe79",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kacpergajewska.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kacpergajewska.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--64a8edac-16f0-43c7-90bf-1f06200e67ed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kacpergolenski.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kacpergolenski.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5cd7ce43-b33c-4178-908b-ac03e2de9be9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kacpermarmurowicz.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kacpermarmurowicz.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--df65a499-3c11-4544-a5ca-713a1575f6e7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kacperobidzinski.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kacperobidzinski.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48c4e043-53e9-491c-9a79-a9b6a018e417",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kadasasia.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kadasasia.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1069e467-a764-47a6-8054-019d9bebab47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kakai.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kakai.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--588d79c4-8bc7-45ee-bf08-0d2b6dbc9b34",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kakii-mpo88.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kakii-mpo88.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--302bda63-c343-4199-a772-cbc7d58b174e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kale-bet-guvenli94.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kale-bet-guvenli94.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a1c7b92-d130-4431-903d-b140ed507be1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kale-enhizli-girsi1.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kale-enhizli-girsi1.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72dd2144-5bc8-409a-a968-c5f3b8a5b476",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kale-enhizli-girsi2.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kale-enhizli-girsi2.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--489893ff-62d2-437b-b067-d473ab0ae844",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kale-enhizli-girsi3.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kale-enhizli-girsi3.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--936b8ef3-06f3-429a-8898-5ce7357edd51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kale-enhizli-girsi4.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kale-enhizli-girsi4.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d567a658-2a23-4bed-a263-7939166eece6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kale-enhizli-girsi5.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kale-enhizli-girsi5.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6b67084-da78-47cb-b087-86d82f737853",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kallen.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kallen.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b2e6cea-00a3-4a75-a188-0ce9952f989c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kalunqerhub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kalunqerhub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c72aa500-2076-40ec-9bae-246badd767e9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kamilkus.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kamilkus.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2832ce04-8151-4635-bdb5-91eb1d86486f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kandu.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kandu.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0f141aa-1ee3-40d7-a731-fccaf84001d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kaostogelxi71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kaostogelxi71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8772d575-e938-45d2-b78a-2356386ab2cc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kaostogelxi72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kaostogelxi72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c75b7d56-aa7f-4fb2-8f46-43d5a1c8fb4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kapaltogel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kapaltogel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0fec18a2-48ea-4cd9-ba0c-d0b7895fa3b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kargabet-7temmuz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kargabet-7temmuz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5d40b24-8bde-40ff-8a69-917996edd1d9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kargabet-resmi-giriss.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kargabet-resmi-giriss.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--62d9c3b5-9324-44be-9c08-ad9076f28498",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karimi.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karimi.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--76d7c49f-796d-4c2b-9a69-6e806c7f771c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karimibakery.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karimibakery.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfef8ed4-c5d2-4048-b0c5-21d16a8f9ec7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karimiconfectionery.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karimiconfectionery.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--450da105-fa4f-4b9a-b778-b083dfe503a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karimipatisserie.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karimipatisserie.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--057330d4-8023-4547-9574-e063fb348d32",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karimisutlava.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karimisutlava.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d89c8dc0-5c8c-4a29-89ab-d2eb1490d75d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karitroxevaladu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karitroxevaladu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8553a6ae-2018-47e6-af32-22e1796b82e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: karol8005.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'karol8005.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea4a4468-b0ea-408c-abc8-cf8d6a4d3ab8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kaskustoto8fgv.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kaskustoto8fgv.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3984f69-b897-494a-9b07-afe1a988901c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kathrynnubbierbdft.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kathrynnubbierbdft.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7d05d5a5-cd2c-4be9-b976-3978c530a1ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: katibpiotoja.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'katibpiotoja.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71f850e8-933b-4c5e-a339-30418a13248a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kav-enhizli-girsi1.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kav-enhizli-girsi1.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddd40624-da67-4ef6-8599-a8716057f68e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kav-enhizli-girsi2.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kav-enhizli-girsi2.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2259ca3-cb2d-46a0-b449-9fb72e2030cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kav-enhizli-girsi3.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kav-enhizli-girsi3.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ace5a1b3-7a76-487d-b266-aa1137f5a0a4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kav-enhizli-girsi4.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kav-enhizli-girsi4.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c8ee668-5bdb-4c8b-9578-e6dd62ebfb4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kav-enhizli-girsi5.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kav-enhizli-girsi5.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--46440cdb-b63e-472d-891e-9b2a1f00a6a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kav-yeniye-giris2.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kav-yeniye-giris2.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec75a9ec-46ef-43f4-9cd3-f860a95f2852",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kaysonyau.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kaysonyau.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5c067ec8-875d-4e9c-afac-3106d88ad52c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kazachok-lord.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kazachok-lord.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38bababe-0286-4139-a488-2da2b6fad0b1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kazuvaliqua.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kazuvaliqua.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e61fba9c-c290-44e7-904a-12c51067dce1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kb137.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kb137.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1946191e-baac-47d1-b8b0-7e0acd4c8d4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kbiolustervella.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kbiolustervella.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00be1d12-2e36-4832-8b9d-351cea4409dd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kc990.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kc990.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21b4c756-0efc-4421-ad6d-2ee564d9ac2d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kcbtgjo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kcbtgjo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc0838de-3d0e-4a1b-a7d8-6d215adc67dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7a226bd-7c4b-44aa-a019-8995804faa39",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc1.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc1.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ab57629b-1df9-4d84-8adf-6d003f62629e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc10.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc10.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97ecacaa-9bdb-4762-8935-a25941d5cb92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc11.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc11.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd4dfadc-f4e4-4e71-8ff7-23e5aaf7fa24",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbb25e99-90db-47f7-8a34-0e045b0beed6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c31bf7a-e7f1-408f-b901-786389e0a05b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc4.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc4.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--051a832b-83be-4e06-a9ec-1116f3f3ddfe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c77eff61-1b76-4c67-bbe2-44caaa05c697",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61b150d9-b316-44e1-8561-47960819e962",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc7.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc7.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30aa1d6c-bde3-4548-9472-dbf3a79d0ba9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8048a54-68dc-489d-b177-27dca28393e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kchjfc9.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kchjfc9.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb77f0cc-d0aa-4eea-beb9-6d3669d6c134",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kcjns.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kcjns.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80ace0a0-e0b1-4ff4-b7f2-fb2c450ec54c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kctvwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kctvwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42ce19bc-daed-4e1a-a3ef-e9471edf440b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kcyzvle.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kcyzvle.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--128c9387-5866-420b-b414-c3904d3415a5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kczvwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kczvwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--345a27eb-ae18-4be1-8afa-7db2e57d0a96",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kd62.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kd62.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d054c15-f0ae-4a71-aa93-6f3d57fd303a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: keaobagg.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'keaobagg.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c55aa698-c341-4344-94b6-67a115707278",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kebavoz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kebavoz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75b20aab-c75b-4b78-95e9-4227de766255",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: keikoandme.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'keikoandme.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7df342f-c2e7-4f13-8d92-9ba8832610c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kelmoxi.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kelmoxi.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2490c9da-b9d2-402d-8915-502777b5e31a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: keminbaeenoso.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'keminbaeenoso.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a13b6b58-5002-4ec6-91eb-09d0602c22a2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kennyrogers.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kennyrogers.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d4c97dc-826e-4fdb-9f5e-a97d319e95d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kenzototo3bvc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kenzototo3bvc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8dccfe5-283e-44c3-8501-45c046732e5f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kerrycheaperinspection78.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kerrycheaperinspection78.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba97d073-6d43-47f8-9a73-5f1ce1ec58fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ketanig.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ketanig.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7984e590-b2cc-4cce-8e00-b3235b58cc63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ketodivate.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ketodivate.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c76f62b8-8e9e-4fb2-93c7-92902d5083c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: keyadesigner.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'keyadesigner.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--93a562eb-ebf8-4bcd-9490-dab0220ab8b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kf4444.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kf4444.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06721eeb-d332-4267-8483-23106f404e00",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kfk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kfk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7b854f85-6ee7-46c7-a975-a50db83ec326",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kfvvzw.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kfvvzw.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95dead22-e18c-45a8-87fe-119cfe378c4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kfyh4zi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kfyh4zi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b13f948-7c32-4bba-b483-40977163c76e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: khabzcustomsintuit.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'khabzcustomsintuit.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c985c964-884f-45ef-ac7a-04fa85377f18",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kheptl.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kheptl.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba56c026-7eab-4120-ad6b-7bdca905e4ad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: khhelooyaarr365.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'khhelooyaarr365.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a7a836ed-72b0-4a2c-ad0b-81c9606c70d4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: khutor-kino.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'khutor-kino.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8bbbcc2-d72d-4964-b182-7e5fe45af904",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kiackgold.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kiackgold.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--618a2070-7a2b-4f11-94ac-9eab42f3fd59",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kibopjexatilepi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kibopjexatilepi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24a845d6-b276-43eb-b1d8-1e3ab54a665d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kickd.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kickd.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a4a8e7f5-813b-46db-8fd4-2c7bf817534a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kickz.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kickz.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9579075b-136c-4650-bec1-7c70898cf946",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kidixteeonacocu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kidixteeonacocu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fec469c0-81c8-4782-9588-eacf72d932af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kigomleduto.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kigomleduto.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7723068a-07ee-46b7-89db-f4aafe83afbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kigracibe.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kigracibe.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c116439-1eea-444a-b4fb-4150cf84cc46",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kilat777jp71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kilat777jp71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb2c7ae7-7cf9-4cec-b75a-213e9dd2d263",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kilat777jp72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kilat777jp72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3dd7696e-fa5d-4333-9573-519f272403d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kinbootchatons.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kinbootchatons.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0442fb14-aa6e-4f85-a505-fa19d61907b0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kindlehammer.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kindlehammer.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87d9c4ca-3035-4a16-b1c4-cf2dc9e9769c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: king-vape.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'king-vape.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--730d4efd-c2bd-476e-b448-b6fa338596bd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kingdom159.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kingdom159.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e9662326-d527-484f-b545-8ab67f953d4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kingroyal-offical.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kingroyal-offical.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e8f769e-e549-4007-aff2-bd0e95785648",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kingroyalvip.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kingroyalvip.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8fe3f242-2a8e-4be2-a727-c5b425b1f27d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kingsleypark.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kingsleypark.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77c48d2a-d514-4dd1-853f-a8c4feb1a7a6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kinomurxo.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kinomurxo.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89b7d180-8c57-4a63-80b6-78d4afb540a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kiranates.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kiranates.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cf2e94d9-0103-46e3-b25f-d2f5ee054c2b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kirs1210.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kirs1210.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9a486210-d502-4057-96aa-c8f5fb8360ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kisanivalano.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kisanivalano.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf8d9d40-a128-40f3-9183-d3771410c786",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kitsdeathsfunding54.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kitsdeathsfunding54.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27b0f575-2080-4f0a-89c5-0339f5552303",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kiv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kiv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1481cb97-c631-427a-b082-3eb19ddf9bd0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kixegcosoavive.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kixegcosoavive.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f443a95-8eb6-495f-ad52-a59a94375620",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kjefgomoradzka.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kjefgomoradzka.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba18c497-a95c-4a74-a829-fb17acfd8163",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kjrxfwe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kjrxfwe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--738017c9-22e8-40fd-b937-b92ef5b0e0f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kkjhgp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kkjhgp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7d4e177e-96c1-490b-8bf9-6df0aff075da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kkkxx.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kkkxx.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--71cf37f5-9ad0-4ed1-b5ad-ded3812270dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: klad-imperatora-final.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'klad-imperatora-final.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--200cb59c-00e9-4fe5-963e-378c207e75b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: klady-imperatora-final.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'klady-imperatora-final.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c70761d-2ec6-4835-a2b3-dc4bd7eb3d02",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: klookshop.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'klookshop.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5145f4f2-6b62-4642-868b-c61dee071c35",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kmj.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kmj.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c36f0e74-0e83-41fb-8ac4-2cb5baab0fba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kmqlyzo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kmqlyzo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d88105f-5210-4cd2-8c49-4b49f9f9550b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kn4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kn4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e229f1cb-3823-4343-b43a-bdeb3fba0496",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knollvault.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knollvault.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdb710cc-c887-409b-ab95-f167974e548a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knowledgespace.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knowledgespace.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0e34079-4108-45e9-a3cc-572edb0d5413",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knowledgeverse-elyrax.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knowledgeverse-elyrax.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fdaeae4a-8710-4bf8-a005-43b615f24bfb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knowledgeverse-evoria.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knowledgeverse-evoria.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07be58a9-f197-4bff-bb18-832740adbe67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knowledgeverse-falora.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knowledgeverse-falora.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a860229d-a247-4c97-8805-dcefdcf9309d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knowledgeverse-galena.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knowledgeverse-galena.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7df2f10a-2f5c-477a-a8ff-f8624643e60a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knowledgeverse-halora.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knowledgeverse-halora.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59b8bc00-b6f4-40b0-b431-2e03ca47a418",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knqmpya.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knqmpya.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6ff2815-b28a-4fed-b95d-7053d1e13cde",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: knutecauma.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'knutecauma.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dd3df7a2-4665-496c-bf25-3308b72beefe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kobzrel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kobzrel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45959448-54e1-43b2-8ac7-b966be4ac6e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kocigxizihe.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kocigxizihe.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e172442-2824-42a9-9010-eb151bc828f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: koett.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'koett.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67aebe9f-f9d3-411a-8187-3e5a41958fbb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: koett.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'koett.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c15f25d9-4dd1-471c-9667-194860ffc674",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kohiknolezi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kohiknolezi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a348c946-9573-4815-b0dc-a340a9345a3b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: koibiyori.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'koibiyori.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ebddc1dd-c5d7-461b-a8c4-21221657ae81",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: koinvegasrtpwin.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'koinvegasrtpwin.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6fe629cb-42b7-42fa-9a04-2bc3c6440e8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kokakola.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kokakola.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4188664b-c940-472b-a7b6-225c56991b1b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: koko303gacor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'koko303gacor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3c4838d-b7b8-49d7-b1f1-af76ed35f0dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kokody88.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kokody88.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cdd6fc2b-0bdc-4036-8b5f-0a6de1e99b36",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kolahbardaryab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kolahbardaryab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d325c6cd-9e67-4610-8526-d4539fbd4304",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kom2026tr.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kom2026tr.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c47d414c-28c1-4ebc-bfb6-9a5032fec3f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kompletly.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kompletly.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ca5d913-72b5-4b9a-8adc-019299534cc6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: komunupload.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'komunupload.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65856f7b-7a90-4621-a1c6-78e2d08ef313",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: konirad.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'konirad.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28366833-869d-47b5-996a-8f849d917802",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: konyalipanel.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'konyalipanel.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2d5e7e1-b1f9-432b-b601-3a333c903b8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kosetpehekaloilabi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kosetpehekaloilabi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--034547ec-4e2b-42e7-bb86-15ac5f5e0c6b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kowia.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kowia.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--800edadb-3624-4b91-bbb8-bbef0b797efc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kpds0018.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kpds0018.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2d23808-05d8-4097-804b-a821cfe9ae27",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kpktoto88erf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kpktoto88erf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e0bf600c-dfea-473a-8c37-02ab29c1d575",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kpmgambroziak.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kpmgambroziak.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0126d422-dc97-4c26-89ce-7999e0ebc05d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kq7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kq7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--903a6905-441f-4567-b417-541641898379",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kq8.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kq8.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3d78c13f-def2-42ed-9387-b381f3e9d6af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kqltwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kqltwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7ef4bda1-1647-48cd-bfd5-8b647c99834c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kqpxwhe.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kqpxwhe.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc92a94c-454d-4396-a049-ef5334e9af58",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kqxchke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kqxchke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--48668fd7-41e8-407e-9535-5ab4a1e1fcdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kr425.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kr425.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--de559e15-59cc-41f1-84dc-151131cb3bd4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: krb.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'krb.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b6cd83a-8cd0-4926-943c-983ef4afd8c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: krecada.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'krecada.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d05b2448-0e9a-418d-8405-298995af04b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: krmeritz.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'krmeritz.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8ecafb3-9360-490d-a774-2b2797dc8882",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: krzysztofkejna.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'krzysztofkejna.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d1298be-4a06-4757-96fe-0bdebedd3e5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ks27vgn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ks27vgn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5f53ddc-e4a4-4d0f-acf1-90fd23ddb769",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ksaji2311123dfsd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ksaji2311123dfsd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3681586-d18f-44cd-888d-549f93826c16",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ksaji23113o21.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ksaji23113o21.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1af40c2e-d9ad-4fe2-870f-06d7c151e197",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ksi-wheel.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ksi-wheel.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1ef1e5bd-9a67-42ef-90fa-1785fb0b1875",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ksprydikh.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ksprydikh.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e6d0564-aba9-47cf-b46f-73113a113caf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ktwxbzd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ktwxbzd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1eb52bad-e4fa-4cc4-95a6-f2cd536db2b5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ku370.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ku370.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf50c545-67b7-40eb-ab66-a9ffd4dec0d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kualitasjabri.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kualitasjabri.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ae82d15-b025-4292-9d93-3856ca954ac3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kukemev.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kukemev.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--57553e02-39e1-473e-8438-8cfad3529f6e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kulisbet-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kulisbet-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--852d25f1-9c41-48e6-8eec-8123ff29a329",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kulisbet-trkazancresmi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kulisbet-trkazancresmi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a069a924-38bf-4b24-8d6f-87fd34214e19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kumar-sitesi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kumar-sitesi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--198302d6-69e2-48fd-9d21-8019a31290c9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kurapikaninjasl77.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kurapikaninjasl77.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b8a861a2-a792-46b1-b610-40179ff7d572",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kurapikaninjasl77.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kurapikaninjasl77.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3cf9af3-c057-4111-9a6a-542b38ff4acd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kurapikaninjasl77.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kurapikaninjasl77.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--075a73a0-487e-4047-8f62-2290b14b83c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kurapikaninjasl77.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kurapikaninjasl77.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f35f3d04-7c05-439f-b70d-54a21e409569",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kurashiminkanoki.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kurashiminkanoki.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--607768d2-3739-4609-aaf6-41c877c9087a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kuwuzes.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kuwuzes.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f73967f-3385-4650-b39e-cffa43e0f270",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kv240.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kv240.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc446eff-1494-4dd1-8884-0dab9fd88731",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kvqchke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kvqchke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1b361614-1526-43e9-a635-1cda556f1eb7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kvtzs9f.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kvtzs9f.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--01102efa-2ebb-4cd4-8dcd-d503a5ce239c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kwnplcaline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kwnplcaline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89c7bdec-e3ca-4890-bc7b-282436db126e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kwnpltech.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kwnpltech.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea18bd34-9554-4bb5-ad9d-2a8b3ce74e40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kx4.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kx4.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c21044d-ba90-4ebf-bd87-98553110e116",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kxptjye.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kxptjye.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2693e65c-e3d7-4b5b-872b-780411771eba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kxwdbcl.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kxwdbcl.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea6d8486-2c9c-4d35-9e50-ed54ecaf21af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kynlor.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kynlor.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53c0e6be-c052-4abe-ab03-e411a7fb519f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kynvox.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kynvox.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f430426f-4528-462e-a947-ad88df726002",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: kz7.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'kz7.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3258d44e-10a9-4be2-a53c-025313e533bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-01.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-01.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7d500c18-321e-4d1b-8947-5f1bf055fa52",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-02.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-02.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04c38b3b-d257-4b63-9b3f-9b3f810b9b83",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-03.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-03.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b088dc2-927b-4f9b-abc0-1a2a8c11b444",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-04.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-04.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--230bdeee-3859-4ff9-9dcc-263ddfabd955",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-05.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-05.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60687342-8409-41d3-a3c8-473781da099e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-06.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-06.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3f82a8c-f343-4a1b-a9f8-63bdb8f503d5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-07.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-07.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--26548e1e-2c8e-4c10-ad47-9cf4ecbb66b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-08.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-08.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ce192db9-7194-4bb1-a640-f52505f8d343",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-09.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-09.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fcaa8d3e-2d15-4c01-ac63-43bf0e896969",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-10.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-10.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b4b1ce8-a3c3-44cb-a005-71576fa24f88",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-11.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-11.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5ba6b06-2d1a-4526-b30e-aec2ce86ba22",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-12.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-12.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d036ce28-3ddd-4f1b-8a63-1dd1785a9bba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-13.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-13.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b09adc3-a070-4736-9fa5-388f322c5a42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-14.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-14.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f692183-52b9-46a2-8cde-d22ec1e5eb2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-15.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-15.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2fa2846d-a8e2-4420-831a-b4d237216e2f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-16.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-16.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87364758-2256-43b3-a70a-cf9be33eef31",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-17.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-17.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c140bd4-9ebd-403f-803d-ba96588c1020",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-18.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-18.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5420c128-6a97-4f6d-9df2-f758e186ed17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-19.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-19.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5968fc94-68f9-4855-a9ea-f100045b380e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-20.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-20.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--66270b02-6745-49bb-8676-721b0d186607",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-21.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-21.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aa235fad-95a5-4192-b6e9-a9e05ab968f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-22.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-22.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4d972e0-1230-44d9-b5d6-34099195006f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-23.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-23.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6a7ffdd-32fd-474d-aa2c-02485aee0b4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-24.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-24.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--008a444b-5175-4501-9895-776abf5448ba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-25.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-25.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--105f0277-6394-46d5-91bf-5d3e07fbce5a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-26.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-26.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d1bc6357-b0e6-416f-9543-acf7c59b9a29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-27.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-27.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3a2379d-bc4f-4d5e-ae80-270309147c09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-28.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-28.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5fbf0396-f589-453d-8ef6-812f3f3c83fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-29.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-29.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0f1f6f8-e109-4c61-8e94-092c399685d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-30.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-30.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2ddecf9-dd9b-4904-ad2f-07c082770455",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-31.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-31.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ec309d0-8a2a-4799-ad8c-f6d1b89b0225",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-32.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-32.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--837fa808-624f-41ec-a53d-5978203f04c5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-33.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-33.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5a314b7-a5f4-48d4-a2d9-3d7add8a8cc7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-34.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-34.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f0324c02-9e0f-408f-8945-d34b725d09bf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-35.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-35.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8fa14e08-a033-42bc-8c3c-64c1325d6bdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-36.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-36.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9728e6b2-249b-46f6-af3d-6b7510524a34",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-37.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-37.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--741829b5-5382-4fee-b8bd-13fc1e5f30d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-38.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-38.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d391260f-028a-4562-86b3-6d9f2c75ce1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-39.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-39.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--803c77cc-0cf7-4609-b486-86589293df90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l-w-z-x-20260706-jauag-sbw-a-40.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l-w-z-x-20260706-jauag-sbw-a-40.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2128aed5-d1b5-4987-9498-69ab9340dca5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l1r2dy4.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l1r2dy4.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f4f6a554-cc0c-4ea3-ae76-bfc301f78050",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l3j593g9cmwhmwnbi6c.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l3j593g9cmwhmwnbi6c.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d159b425-e8d7-4254-a331-c9901e4c12ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l6smtqqrm19vfhn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l6smtqqrm19vfhn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9fc22f87-6b8f-4111-83aa-5d2d55d00b5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l8s5qys.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l8s5qys.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69315f74-949f-4637-9ea7-01e0e9b633fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: l9n.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'l9n.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f3faa032-cf89-4916-abfd-78d38048520b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: labeskenetete.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'labeskenetete.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--24c9a9c3-8966-4743-8de5-4b9af66f46eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: labubu789.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'labubu789.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--68f442b5-bee1-4112-b690-8233abbc8f68",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lacehtizaloacumi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lacehtizaloacumi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--25657142-41ee-4be2-8abb-d5a9e009cb57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lacomhojeme.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lacomhojeme.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8e3bd8c9-46ea-4f02-8e4d-cba9285dfeb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lakegenevalife.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lakegenevalife.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2769e5e7-5ca2-4d24-8651-06db92833f91",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lamotnaudina.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lamotnaudina.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--524331e1-455a-4cd6-a960-1badf2835d52",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: landhold.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'landhold.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52a26c20-b1df-49d5-9f96-83eb741cd4a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lanonbinanoolepo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lanonbinanoolepo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27a5c82f-d06a-4d7b-a256-1f9c50215769",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: larisbet303.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'larisbet303.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a437d67a-3208-40fd-ad13-1076e9a3e34d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: larisbx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'larisbx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bfc8e59e-c3f6-495e-a270-59505a9d6315",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: larlikeelses.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'larlikeelses.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--22cc33ec-8ebb-44ba-9f82-9e4948dd077f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: larping.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'larping.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--63d8e589-b4b1-4c01-bda5-a1cff5175898",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lasinpopearaahaje.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lasinpopearaahaje.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ea521ba-af4a-452d-bfa2-d1d9f95b78f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lasvegaslv177.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lasvegaslv177.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b3250583-0358-47c0-89de-4d82a573f649",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: latoto99ggf.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'latoto99ggf.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2dd5c67-6e95-42eb-b53c-08ab24dd8f12",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: laundrykirana.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'laundrykirana.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--38cb5eb1-0144-435e-b46a-6f1d35c15a8a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: laurianmarkettech.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'laurianmarkettech.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ed2b8f04-905c-4e59-afe8-47359744c5c7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: laurn.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'laurn.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--968dcc49-631c-4791-84f7-ea88267e482b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: laurn.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'laurn.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c7a55c3-c80a-4274-ae1e-ebc65f7af15a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lawestateassurance.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lawestateassurance.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2f6118e-dfd0-4e03-8d5f-0bc0a90f337f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lawrefundback.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lawrefundback.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aad7aab6-c323-4ea7-9f4a-96f0d13402e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lawrefunds.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lawrefunds.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4ea41239-05ef-40ff-b9cc-6b19766a8f86",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lawyerrefunder.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lawyerrefunder.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d8424cf7-66d6-4577-90ee-81cfe9874174",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: laxobug.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'laxobug.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6b290b45-e05e-472b-9397-df7aecd006c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lazpire.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lazpire.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2405fa74-aa9d-49ad-8f46-453d0e0df0e2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lazycat.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lazycat.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e6100b57-3eb3-484b-babf-67ba2893c120",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lb1.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lb1.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ef9f30b4-aadd-4910-8bc4-43b24d52d13b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lbe6ju2.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lbe6ju2.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--61f13a11-52ee-40c6-88d7-120ae61dccf9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lbtwwj.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lbtwwj.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f628ee5c-2c10-4e74-9493-71a60ca03a74",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lczgyno.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lczgyno.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eea940c4-dcc8-4cc6-9f42-f9c79b38ed6b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ldconsulting-rhpaie.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ldconsulting-rhpaie.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23e80eb1-ded9-4e28-9928-b32206f83889",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leadbwnlab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leadbwnlab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--42e0adf5-9fc7-4753-ac5c-2239d1a9355b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leadbwnplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leadbwnplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cb266427-d1c1-4dd0-ad37-47646f9947c0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leadexecacademy.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leadexecacademy.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b5cf6cd2-804b-4ea1-9cdf-77ddab6933d0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leadimpactlab.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leadimpactlab.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0516003c-5026-478c-b5a1-c2c7f64084da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leadkworld.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leadkworld.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--47ba16f1-0e65-415e-bbee-d8fd1e3d2029",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leaftide.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leaftide.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--250508e7-06b6-4ab7-8fe0-489cd12322d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: learnandearn.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'learnandearn.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1bbb4b5d-47a8-49ad-bb07-c6f2b9698689",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: learnio.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'learnio.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--49b78c53-0d16-4f7e-972f-d088d8fe499c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lebetelborj.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lebetelborj.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c5a0c02-3f67-4166-8c88-ede127d23efe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lebin.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lebin.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--30096b07-04cb-44f3-b84a-94ea8b62dc90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lechoslawgrzonkowski.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lechoslawgrzonkowski.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--27670239-f0b1-4543-86a0-1514c23723ec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lefatus.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lefatus.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6fd2394-275d-4fad-b3da-a75e30c51960",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: legallyproperty.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'legallyproperty.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ba50f40-2f4f-4480-91a1-c42154789101",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: legalrefundprocess.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'legalrefundprocess.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--52f02f0a-ac96-4f5e-aca7-8f8aa3d24edf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: legegraviailele.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'legegraviailele.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--88047cf6-f713-4c1d-9f2f-da6e9423e931",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: legendskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'legendskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f6f42e4c-90e5-46bf-96cb-42b407bc6543",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lekrom.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lekrom.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--efbc6f5b-c86a-4e55-922e-8b8ff4cb5c17",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lelyonssllotssfr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lelyonssllotssfr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--367d382d-c4a2-454a-afd2-ceb91d3aa89f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lem9s.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lem9s.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--36d14835-f87b-45cb-8c72-e917cef81c09",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lemondeeberyl.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lemondeeberyl.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c6a63c8-a9a6-450a-a390-4a97fa52d847",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leravmorix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leravmorix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--67feaa30-3ac5-4de7-9186-d0de4b3673d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: leren.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'leren.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b93834d8-ffe1-49e1-ab49-7d1976a16b0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lestarias.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lestarias.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ac3225e-609f-4635-bba8-b0173bd59efb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lettersbarriersranking43.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lettersbarriersranking43.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--379679a4-1a18-4156-84a7-fe9d03842156",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lexasfenoeekimo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lexasfenoeekimo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c7cf92a-0b54-4386-933d-65d8c8b8c964",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lf200.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lf200.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8af4e7f6-6cc3-4278-91a1-35699fe9892c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lgmss.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lgmss.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec8db7cb-996a-427d-8432-222b3e4b9ff3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: libpuwertus.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'libpuwertus.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2621bc1a-afbb-43b1-8237-74d71d529989",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: libreriapensa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'libreriapensa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3151195a-4316-4d91-8912-442f532434e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lidealeitaal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lidealeitaal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ce15d4e-107a-4d54-91ac-97fae1ba6e78",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lifebizcoach.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lifebizcoach.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--157803fb-bb86-4439-b0c1-dcf07822305d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lifeharmonycoaching.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lifeharmonycoaching.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dfa78a61-ccbd-4bb7-9f71-da43b74a1a03",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lifeup.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lifeup.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--770d6243-e4bf-4101-b4b8-83b2cf460025",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lightcloudbox-uty.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lightcloudbox-uty.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c0d0091-1ffb-49e6-acde-18175c34692e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lightfoxhub-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lightfoxhub-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--576accdf-4065-4723-adb1-4c8729afb79c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lightwavelab-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lightwavelab-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f388f0e8-5b9b-4a10-9d38-03866c246084",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: like-cazino.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'like-cazino.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--913b2ad5-7543-4056-8c41-19ab3a8749e5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: likyam.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'likyam.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--40690a6c-eb82-4ceb-bb35-14f847a74b4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lilacriver.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lilacriver.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--dbf1960d-5019-4311-9d68-3b210b0be53e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lilasetaserkasero.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lilasetaserkasero.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--894700d8-09ee-404b-9141-d4ab2e6f83da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: limauicekurangmanis.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'limauicekurangmanis.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9f476572-f2ba-41eb-ad82-dd74b6e0a1cd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: limforge.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'limforge.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--17106f97-be25-45e7-b088-ed6b5206d40b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: limsytarascobatussi.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'limsytarascobatussi.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97725021-4ce0-47bc-af0a-0fee72641fb4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: linenspadethroat.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'linenspadethroat.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f94a7120-126a-4056-88b5-663482fc6a3f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: linicilesi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'linicilesi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9fadc8b2-6353-4bc2-9fd5-6a982e28171a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: link-hape.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'link-hape.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--07ae7590-c286-4734-afc5-a8f57fd199f8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: link4koko.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'link4koko.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--82578cfd-dc76-4412-a77c-4f995a0c6d87",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: linkasiaroyal88zona.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'linkasiaroyal88zona.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4fe4179-676d-4cc0-a0be-55d32ce9a4a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lipegbinisearaipofi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lipegbinisearaipofi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9221d1b9-c095-4c4f-abad-490b43165698",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: liquidityplan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'liquidityplan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5b1642fd-290b-4495-8a17-2f32ccd91b25",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: litangg.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'litangg.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2dfd1d09-55e2-4e1e-a0f8-9f5d6ade17aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: liubloa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'liubloa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5bf7e282-02f2-4f54-a07d-fef48160ca42",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: livebox.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'livebox.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87bf164b-edfb-44c2-97dd-0eeb4d0a2154",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: livedrawsydney.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'livedrawsydney.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--049344aa-0ace-4091-9c5f-57d4a9641c47",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: livelyburger.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'livelyburger.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aad5eaca-ab46-42f1-b46e-36b8bc37e41a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: liwiatryczynski.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'liwiatryczynski.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2df98e99-8b38-4865-8161-e20f8315cdef",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ljfv.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ljfv.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--878a69b9-f0a1-4b41-8d36-dbf4c01ff788",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lkdsfngklndkg.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lkdsfngklndkg.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6af9a746-96a0-41f9-bf57-eb7d1c34c17d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lkjln6vku9wy5ni.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lkjln6vku9wy5ni.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1dfeff5d-cf69-4328-8d0b-4dc2d5f925fa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: llelyonsllotsspt.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'llelyonsllotsspt.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ddee11b-9305-4306-bef6-828bec606071",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: llelyonsllotssro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'llelyonsllotssro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0d159c24-7939-40b4-804e-2f3521d495c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lm9.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lm9.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4dfdd599-4503-4d35-ab9a-5c684cc5934a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: localai.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'localai.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--33080ad1-4948-4844-9010-8ba3c1652f1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: localhub.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'localhub.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13a7d68f-2398-4c72-a3fd-abbad6fc1fcc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: locandapogioleoneita.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'locandapogioleoneita.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c97d6df-431a-4aef-aee9-19183cc16ccc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: logi7x.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'logi7x.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--076af920-d64d-44e2-bd59-5506c8cce737",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: logicrun.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'logicrun.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e13cdfc9-0b8e-45ef-8848-fec05d9baa41",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: logicunhab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'logicunhab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db598761-7fd4-4696-94f6-b5db92d6dad3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: logtrip.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'logtrip.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8bd64992-8ca3-46cb-bf57-976c62cb2379",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: loisrelayer.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'loisrelayer.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8f9140c-e4a7-4139-b815-a9e758ed8a67",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lokalna-2498.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lokalna-2498.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--423630c9-bc9a-4cdb-a8bd-e90c6e541866",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lokalna-9881.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lokalna-9881.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fddaae6e-797a-41f0-9648-103c92695d0b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lokalna-ofera5684546.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lokalna-ofera5684546.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5ce536b-445b-4c28-97b7-820949a12432",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lokalna-ofeta197891.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lokalna-ofeta197891.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a58f5549-7ee9-4f0f-8a44-70a6a50ef34c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lokalna-ofeta76546.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lokalna-ofeta76546.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ada017e-17ff-4b65-9fc7-cb1856f79b4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lokizy.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lokizy.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bbd1907f-8b41-48aa-84c2-0af00ed2bc0f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lolakmerezeojabu.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lolakmerezeojabu.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e65c1f6-3aa1-49be-bc2e-47bfbcf820b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: loliloli.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'loliloli.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a1ddf13-9ad2-4946-b1d4-0a4b7867f82d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lonab-caslno.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lonab-caslno.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--06cd5858-043e-470a-ad66-fab166cb3872",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: loockskillvote.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'loockskillvote.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0485900-ab39-41be-8e2b-417fd6be531e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lord-filmhd.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lord-filmhd.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--99720be1-efe2-47f3-b225-166cc1e8f072",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lord-serial2s.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lord-serial2s.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fb76525e-439d-486b-aefa-440bc2f61102",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lord-serial879.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lord-serial879.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bdb6b704-5622-469d-a4f3-c6e919ba4f9d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lordfilm2r.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lordfilm2r.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4cb1ea98-bd49-4e74-8da0-5e03c538a3d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lordfilmarchive.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lordfilmarchive.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--96508787-c705-4ea6-8a7b-03cece9a613d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lordfilmranch.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lordfilmranch.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4514405e-6425-41ec-8692-f522ed1fca5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lordfilmstone.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lordfilmstone.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a8cf50ab-e6f5-4851-adb3-4fdccd648bc3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lordserial565w.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lordserial565w.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--147e4c99-a66c-4d94-a6ba-892dd0ae7b4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lorisdivas.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lorisdivas.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7341b686-afaf-489d-95f8-393433281b3a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lotbrainmouth90.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lotbrainmouth90.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f94bf592-d9a2-45c0-b9bf-0412f8d70144",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lotisfavifeaevebi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lotisfavifeaevebi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1136d22d-dbee-46f9-9c10-7ce64bf6d506",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lovelyfeature.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lovelyfeature.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f7ad1262-9d42-4d2d-a23b-fec507471abd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lovelylabs.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lovelylabs.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cc06f79c-5ba8-42ee-a500-e672d2fcc3af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: loveu168.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'loveu168.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a980711-60b5-4464-9993-f79e8f5c4fd6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lovospinoeonadaro.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lovospinoeonadaro.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5a45abf4-b601-4a8d-8646-aa2f51de3d56",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lovve.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lovve.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f668c672-8662-4de9-9a7b-c453edfaccdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lp6sc7zhmg9grxi.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lp6sc7zhmg9grxi.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a38a698a-e7ed-42b9-a5f8-e61c2dab336c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lptygfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lptygfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--282b746c-4e32-41ea-abd7-79d7b9072954",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lqhgyfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lqhgyfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be95122a-9ed7-491f-9952-101c52ab0d8d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lqvxgfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lqvxgfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cd128406-1658-41d1-9a12-ad40c3d4b66b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lqzgyfo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lqzgyfo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3aa2e470-a5c9-4325-9fc8-28aa5677eb81",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lryqvmo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lryqvmo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d34eba3c-416f-4aeb-ab2b-ac429d262f8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lse0981.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lse0981.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c2ded847-a8fc-4522-bc10-c26350e1d3db",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lseg-uk.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lseg-uk.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0993b79a-dc6b-46c3-b102-21f972e1b966",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lsn2e0b.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lsn2e0b.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1072d1a5-0d87-45d4-8288-5c7eeab2accd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lt-business.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lt-business.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2a26a3c6-1523-4b70-8439-25a759e47573",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ltic3u8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ltic3u8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e10f43c1-e64c-4afa-b5bd-1dab6a429473",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ltk.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ltk.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d440bc8d-7932-4a7a-ac9c-902b9d8358e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: ltvhzne.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'ltvhzne.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--53d7419c-20ad-4564-bf90-4178497f95aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lu345.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lu345.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f91f0e6f-0969-4b43-aad7-f089387fe9b9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lu3exihlt1qokof.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lu3exihlt1qokof.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65731f6b-5319-4819-aa67-9e7f7cc78d7b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lubaca.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lubaca.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f8024d82-321a-411d-96b0-1535e023f984",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lubaca.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lubaca.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--37c6ee38-32d7-41a4-a9f0-ab2fab564f60",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lubeoradaentari.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lubeoradaentari.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8224522-168a-4392-9095-261c2343d635",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lucidium.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lucidium.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0b7022ef-3b5c-418b-ab7c-ef234748e3af",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lucky-palace.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lucky-palace.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72611bdd-cd57-45d4-98eb-26f423ecefd6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luckybearcasino.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luckybearcasino.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--344d9033-7285-48fa-983e-2103829bef3e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lueonzewyta.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lueonzewyta.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00951402-1027-4647-9df8-996d70f741f2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lulas.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lulas.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be282372-a1f0-454e-90f5-feeb09902425",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luledax.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luledax.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e7e952dd-b913-49e9-9e72-a943ccb65a2b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lum2e.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lum2e.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4324998b-3a98-4d18-89e1-46fe1a69e539",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lumenix.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lumenix.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d38d6057-cce6-4655-b54d-7fb13133f2ee",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luna77dua.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luna77dua.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7a3104f5-c626-4fb8-9553-f03857d128d2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luna77dua.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luna77dua.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5befb2d5-26ed-44ea-883b-e9664c0995bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luna77dua.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luna77dua.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fc240854-11e2-4f00-a12b-13705ed0c65d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luna999.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luna999.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c0a9ddd4-d52c-445b-8791-48572f3c60b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lunabettr-guncel.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lunabettr-guncel.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f47a3d0-0be1-4af9-b8be-65d9aeb6aaa6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lunaras.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lunaras.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7c9b9973-c892-4f3e-bfef-cae48a54fbed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lunarscope.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lunarscope.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--adb007d3-27f2-4b49-b14f-7319d2cd3660",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lunlimfg.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lunlimfg.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc3b71f9-8aca-4fc6-a10d-0164339b583e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lunovekar.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lunovekar.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--abf8c6ac-1be4-4b5e-bf65-281a15cb6d82",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lutixiw.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lutixiw.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--21d62660-3816-45af-8cee-3aaa3b28815c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lutupum.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lutupum.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4225e37f-7481-4614-9afc-2e4eb587380c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luwodug.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luwodug.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--15a70503-c9e3-4a6a-92a1-2efe1c3f0dff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: luzerol.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'luzerol.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--772d8c19-995d-4b65-82dd-c394d6a6fb43",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lwf.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lwf.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f226fde5-fa20-43fd-a059-f7cae2ef944e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lwhbdpz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lwhbdpz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--43363204-2283-427e-8100-f96b4866d235",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lx2b8jk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lx2b8jk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11cdc903-a195-4f3f-98c4-b2eba3bffbad",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lykzhm.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lykzhm.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8c3b77bc-e254-4117-95c9-02d271b6997d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lyltre.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lyltre.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2028416e-d24c-4c40-9d45-92ebb88727ff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lyopsgr.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lyopsgr.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e2de7d96-6bff-4968-9399-61b4fe92735a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lyrascans.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lyrascans.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0dd64e08-7a91-4915-82b8-ecd34f2870e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lyrickapithaven.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lyrickapithaven.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--91ddd99c-0090-48f8-8d72-00dd21386f1a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lyvqxke.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lyvqxke.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c4dc3fe-ba0d-481f-98ce-3475db2fd88b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lywgqce.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lywgqce.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95485f02-1e3d-43f9-821d-da526f0438c1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lzb0b6b.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lzb0b6b.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--780725bd-aae8-41b1-9b0c-89d89d515494",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lzewfjo.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lzewfjo.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2cb4e304-9b1a-4843-ba2b-699530e9a4ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: lzxcamel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'lzxcamel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--56446950-b879-4656-bb5c-f52291a23eed",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m0vy9jo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm0vy9jo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4d1b1f9e-1639-45c2-bc96-a89b38a52da2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m1k7x4q8v9n3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm1k7x4q8v9n3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6ea36aab-749a-43be-ba12-015a0bdc26b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m4bx61g.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm4bx61g.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb50bc8c-e51e-4643-b8ac-dc3070c10373",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m4z.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm4z.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5dd31e80-4bd6-4825-a85e-8e66ab315e8f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m6p.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm6p.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--50df6eb5-692b-4706-9f1c-136994b9c207",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m6x.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm6x.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--20558b98-4996-4fca-8897-2dc533230172",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m7q9wa.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm7q9wa.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--801618f2-4a6b-4fa9-9a4d-ebba44741c93",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m8q0a6i.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm8q0a6i.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c9c11ed6-d4d3-44d8-9ac2-943e325f5b28",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m8va2pk.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm8va2pk.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ec316ca5-763e-4050-bdf6-482b78b262da",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m9h.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm9h.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1588dc17-2851-47ec-bdf9-fb0927b8986a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m9j.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm9j.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2e5c9fcc-4a16-4538-9a1c-c9915ccbfe00",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: m9jwnvsj3ohacpx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'm9jwnvsj3ohacpx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a72c45ae-0d11-4f85-8e3b-88602a9349d1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: macisofile.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'macisofile.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--285f1fc1-cf1b-4075-a4a5-bb3a08e55773",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: madiina-tadj.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'madiina-tadj.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b6588a41-3faf-400a-83a5-2694f422e268",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: madinahonhasanova.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'madinahonhasanova.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aedb802a-ba75-4ab1-a450-63052fd58e75",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mafemxicerivedola.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mafemxicerivedola.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60c4131f-7755-45ab-ab97-665e9d76eef2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mafiainter.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mafiainter.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f367a3b4-5a39-4be7-9e9b-fe77495f83fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: magdalenabialecki.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'magdalenabialecki.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fe9f0793-3e8c-405c-af30-60028c9c55c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: magenersverrrified26.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'magenersverrrified26.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e4124c10-3756-4be5-a3da-381d8bb63554",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: magentci.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'magentci.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--75e1e49d-9323-4825-a85e-b6f8edd28e58",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: magnatejuicier.qpon",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'magnatejuicier.qpon']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-qpon",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f21c9b18-9623-4b8f-bb82-6524bf490ec5",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mahakal365.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mahakal365.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--13bd9824-d01d-44bc-aa3e-ee84999fa45c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mahanbadr74.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mahanbadr74.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--006f3fad-e3d4-4972-b42a-473684806d35",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: main-src.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'main-src.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--80ba075a-4ebc-425f-8c89-c72013000a51",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mainslot877xxgs.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mainslot877xxgs.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8cc184d9-0423-40eb-9551-a08d7e685f2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majickkala.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majickkala.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e8dec9d3-b8f7-4ba9-a726-92b8461b4aab",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44c4f9c0-138b-465c-8f5c-f139e818e5d8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp1.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp1.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8b29711f-753d-43dc-b238-56319fe653eb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp10.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp10.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b14a73bb-f316-4d75-930c-d23ddbd71910",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp11.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp11.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c8d94fda-b035-4724-9778-3227dc31a343",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp2.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp2.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--97d25cea-49e8-434b-a333-2437fe6beb5d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp3.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp3.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87024a4e-eda7-4f58-bc84-9527fe14d6de",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp4.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp4.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ca2d31f1-ebf5-4283-8fab-c1b9867328a8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--aea8564d-9558-4f79-9b7b-53599b97763c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--be00aee8-ef6c-4218-bfb7-6ac7be3fdabf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp7.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp7.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b01b71ae-34ce-40bd-94b9-914e255aebfd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp8.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp8.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b36d0867-0505-4b1e-a2b0-3f56cef91e77",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: majorcp9.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'majorcp9.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--60825eba-ce35-4178-810d-0ccf95c798a7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: makeitcount.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'makeitcount.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a06ba8e0-9237-44bc-85a3-26df155a764f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: malgorzatadrzewiecki.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'malgorzatadrzewiecki.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c0bc0be-173c-49dc-9322-5d69d2953fdf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: malgorzatajanda.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'malgorzatajanda.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7dd2f3a7-87e8-4a85-b278-fa5c07c58062",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: malkosstov.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'malkosstov.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fbd25775-cfff-4291-a115-7202f0df29fe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: malukutotoxi71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'malukutotoxi71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d2a46d9a-61c6-407c-8784-9311d6832b19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: malukutotoxi72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'malukutotoxi72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1aeeb41c-1d6c-4126-a02a-5bbe5ad587fd",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mamatooadashofloveinc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mamatooadashofloveinc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1d8b3ee8-c473-4aa5-99a1-9e26bbc47cb2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mamen123.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mamen123.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03c4915b-c49f-4189-94c7-140de8336c38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mamen123.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mamen123.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--145d396d-0074-4e43-b670-c52b6c7561a1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mamen123.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mamen123.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b73b5a3-7d5f-4ec3-8407-85eacb5c267e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mamen12388rrt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mamen12388rrt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fab8be70-eaa0-4dc2-a91b-68830c2374e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mami188iiqq.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mami188iiqq.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14a6d13d-1308-4e51-8015-30b6ac0c9382",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mami188qqii.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mami188qqii.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--720a8dba-faeb-420f-8feb-5f2f9068edc8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: manadbegege.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'manadbegege.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb22c47d-b088-4b44-b482-a43b67c84f8b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: manbunty761.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'manbunty761.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95bed7dd-67be-47b2-89b7-557967695841",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mangoaco.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mangoaco.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--564c8c42-dbca-4771-8dba-6ead8d8ffa40",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mantra200qqw.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mantra200qqw.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--72adf3b1-4f7a-4c31-ab4b-4d2426122523",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: manuf5.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'manuf5.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3e765997-6466-4354-bbdf-e758e35f9e53",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: manuredplumbumgunnies.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'manuredplumbumgunnies.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3da55b31-625a-4c2c-94e4-7f1f8cfbec08",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mappartfestival.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mappartfestival.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cbd85b49-3e06-464a-ae8f-52b2b7bc9b92",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marang.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marang.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3323f0ce-97a2-4089-946d-c1aadbe1979c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mardinos.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mardinos.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c5f453db-d67f-4cf3-af9a-d31afde546d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marebaccop.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marebaccop.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--fabbdd39-350a-42ac-828e-b72f7fadbb7a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mariatogelxi71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mariatogelxi71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--83b3341c-e7f9-4a3c-9910-a05113c74985",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mariatogelxi72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mariatogelxi72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--14cf0548-776c-4b1e-aac3-5a6db924c3ac",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mariobet-girisleriniz.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mariobet-girisleriniz.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--28f74bfb-150c-4f7b-8825-274669c46907",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mariobet-lisanslar.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mariobet-lisanslar.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0a253837-a4e1-4a75-b41f-ce94abb99b4d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marirasakan.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marirasakan.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e0c955a-15c6-4979-8212-2801673baaa4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marketingx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marketingx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cddb65c8-ea9c-4f6e-927f-7c6ba0db538e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marketiva.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marketiva.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d7b6c01e-725a-4fa8-a376-6fece2c08617",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marketplace-date.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marketplace-date.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bfdb0d7f-148f-4ae1-bcbe-b4ccc4835aeb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marketx.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marketx.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f241ba2b-525f-4b11-810e-930ec92dced4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marnovixa.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marnovixa.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--881790a7-030d-4087-8377-f1b091279bcf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mars-bahis-dogru26.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mars-bahis-dogru26.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c597bfb1-d943-477f-95b4-5c0f74bd3ed1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-aktif-app.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-aktif-app.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--35ac863e-3793-4dfc-a26d-4a414eeb073d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-aktif-giris-yeri.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-aktif-giris-yeri.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1f506e8b-5f05-48ea-8af2-1fd4be607d4b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-aktifgiris-adresi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-aktifgiris-adresi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bd26b83e-e0ae-4583-895a-82be900a62c4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-aktifgiris-yeri.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-aktifgiris-yeri.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--95e6ca14-459a-422f-af2b-010a17b76160",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-casino.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-casino.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b0a20c2d-3104-4913-a31b-72f79d770a7f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-club.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-club.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a91ca037-7c44-4b61-9dd7-6855f813a9f9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-giris-mobil.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-giris-mobil.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--522232df-5ca6-42b0-b304-a66eeae3b3a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-girisadresitr.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-girisadresitr.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b9414f63-b700-4389-821c-9c8fc75200dc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-girisguncel.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-girisguncel.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--65b6ac4c-2087-45cc-870e-98edaec41656",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-giriss.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-giriss.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6497acc5-79a7-48ea-8970-e6a518060521",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-guncel-eris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-guncel-eris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9ba71017-f6bc-4311-905f-c21c3782f403",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-mobil-giris.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-mobil-giris.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--51ec9d92-aa56-44a2-92bc-1cc525c7b287",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-mobilgiris.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-mobilgiris.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c20ebc8a-ba4b-4b4f-9922-fb449243e7e4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-mobilgirisadresi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-mobilgirisadresi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--32672fb0-d528-4daa-9c00-991366c22642",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis-resmiadresi.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis-resmiadresi.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44a749fa-1b86-4884-ad10-f8274e266a57",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahis1128.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahis1128.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e5e80366-bb2e-43aa-8ca5-8d5654c012c3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahisgirisnow.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahisgirisnow.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--756e165c-fa1d-4c7f-a082-c85cacba4aec",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marsbahisyeniguncelgiris.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marsbahisyeniguncelgiris.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ea869548-767f-433c-9a0b-6c467db55122",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: marzannakurcz.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'marzannakurcz.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1c4b52fe-8516-4706-836e-1f47e7e2a37b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: masirloceje.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'masirloceje.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1993af73-44ce-44b0-a07a-0e7fb9f156fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: masterbetting-7temmuz.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'masterbetting-7temmuz.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a157097d-c384-46b2-afc2-5ab6387cb0e0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: masterbetting-resmi-girisler.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'masterbetting-resmi-girisler.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44436b95-21e9-4420-8793-0e5f26254fd2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: masterexecutivetraining.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'masterexecutivetraining.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ee9d0f35-5c6a-4e62-ad52-c9ff335a5391",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: masterrtpslotsgg.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'masterrtpslotsgg.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cff86a78-185b-4ba1-ae97-c341229cd3f1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: masterypodchannel.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'masterypodchannel.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--594b526a-38b4-45ae-a63c-69a17f142873",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: matbet-klassgir.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'matbet-klassgir.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f2d56570-b760-4ea6-9fa4-e5d8f31c139b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: matbet-player2026.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'matbet-player2026.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6d3e7b03-ca3b-45f3-8a04-00efdddb3dbe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: matbetturkeylive.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'matbetturkeylive.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7f02cd88-c28d-4748-9da0-3f99a447424d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: match-ispaniya-portugal.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'match-ispaniya-portugal.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c60764a-fa94-474a-88c5-11c4d6d963b8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: match-portugal-ispaniya.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'match-portugal-ispaniya.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0c2bdab4-2848-4e70-b3aa-51e91e4c038e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: matejko.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'matejko.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5f032e71-f619-4584-9093-040a8b40a4aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: matrx6.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'matrx6.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b4346083-dd88-4d3d-96b0-8eab7e041135",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mattyoung.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mattyoung.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--af21cdfc-9bda-425a-97a5-bd69e7928e54",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mavceto.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mavceto.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ac127edc-880a-4438-b187-9a7957f5193c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mavefsitihearolona.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mavefsitihearolona.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d396ea7-d3cb-4ab8-9644-b6e8260adcbe",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mavi-bet-aktif14.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mavi-bet-aktif14.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5235580a-510a-42f1-95bc-4a23993e2955",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mavi-bet-dogru18.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mavi-bet-dogru18.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--812860a5-d2e4-439e-81bf-425c0454b73f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mavolqixai.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mavolqixai.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--87abfdeb-ee80-43e1-9f26-5a81abdd9198",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mawartoto77jy.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mawartoto77jy.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a29f4361-49f1-45e3-b525-1ef10fae9dba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mawartotocds.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mawartotocds.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--815408c1-1a23-4bde-843b-bde5addf7e80",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxanhubcore.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxanhubcore.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c219c1d-b1d2-4c27-a739-88fe8d9f1b4a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxanhubnest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxanhubnest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--92705fbb-6d02-41f3-bf46-f0a849df77d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxanlabify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxanlabify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--deecc941-5ce2-49d2-a2e6-d0932c1dd0d7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxanlabway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxanlabway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--987be81f-e98f-4a65-9eb7-1a39d607e831",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxbirdnet-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxbirdnet-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e10bc444-b876-49c9-838f-d09fcbde076f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxboostzone.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxboostzone.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b54cb779-d451-4433-bcb6-f5c3a3dd6f90",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxbwnpehub.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxbwnpehub.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a15985b4-90bb-4011-b2b4-3a46ff1ee757",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxcloud-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxcloud-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e1f99f2c-c0ed-4e54-ae77-b39b956001aa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxenaewai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxenaewai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ba050ba3-8c36-418e-a80d-dda9c2399bce",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxetricai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxetricai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f219e9a1-8435-4ae1-adae-c076731ee207",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxetricflow.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxetricflow.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f0376de-7bdc-46b4-a5f0-b38474e67390",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxetricweb.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxetricweb.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--993e18f5-04b8-49d9-a821-df796a7b7db2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxewhubbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxewhubbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5272ba30-3524-4f12-a806-1ea3f1424811",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxewhubview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxewhubview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8d5fd580-7206-4998-b983-2ee0700bff5c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxfieldlab-uty.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxfieldlab-uty.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a85f158f-73f4-4516-a7e7-64bc09c5ef0c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxfoxnet-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxfoxnet-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--464145cc-94da-4cff-ab15-4bae9f33aeb2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxkwnplai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxkwnplai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a79381ec-05bc-465c-8542-20a5e35534c8",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxkwnplline.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxkwnplline.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--00ef5560-f032-472f-9299-33b0560198e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxleadbapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxleadbapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a0bd2dec-4a6b-4829-9d63-283a8b898c11",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxleadbview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxleadbview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e07f2bf4-3f81-4e10-a472-d5546867ad19",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxleadbwn.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxleadbwn.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--44377c69-7a54-4626-bfe6-9db443dae9fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxleaddbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxleaddbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4e6a27cb-7fad-4938-bb6e-d9846e6cd29e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxlionhub-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxlionhub-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a5a32e6b-535e-40eb-9c54-2f9f0834835d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxnflowgrid.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxnflowgrid.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b1628eb9-5e15-4fcc-bc84-e23956657e52",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxnflowify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxnflowify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--34b473a7-8d95-45ae-b5c9-64e1ebc64f2a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxnflowlab.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxnflowlab.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1e63514f-f940-4274-95fc-836928580b29",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxnsyncdash.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxnsyncdash.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1211747e-1cb9-436e-bf70-9d778f323dea",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxnsyncify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxnsyncify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9e669824-36fa-4b03-8921-5df0a2caf17d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxnsyncview.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxnsyncview.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--69e3727c-08d2-45f2-99cf-a667263387b6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxolvannest.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxolvannest.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d92d912b-158c-4d55-8613-c64e660ea80f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxpixelhub-salo.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxpixelhub-salo.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--59b60be1-0898-49cf-aae1-8ae0c435af73",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxplcanai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxplcanai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4bbbfd50-e582-41d7-ae28-d6890e268263",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxplcanstar.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxplcanstar.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e3e30ad5-d592-4f47-b8c9-ee3adef68c1d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxsmartcore.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxsmartcore.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7fb3b9b4-01ec-4310-a96b-30fd290c487e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxwinngirisi.icu",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxwinngirisi.icu']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-icu",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--db252097-4699-4f12-8e9d-0b5674df6caa",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxwinrtpkoinid.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxwinrtpkoinid.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b497f9a2-937a-4ecc-b2e6-6429c1c564d6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxwsyncplus.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxwsyncplus.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77f0ed48-94dd-4032-aa28-7944755f557b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxwsyncsky.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxwsyncsky.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--186ea6ba-6958-4f92-9e53-f6667d0b7246",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maxxotech.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maxxotech.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bb1ee483-1aef-479b-84e0-c34e298d45a9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maya4dkkm.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maya4dkkm.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e33e7d38-a405-4f66-9f53-83469d009055",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: maya4dmmg.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'maya4dmmg.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6c534d76-59c3-4fce-aa03-d4b194e6b542",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mbe4yd.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mbe4yd.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4f21736c-14c8-4d75-adf4-357c703ccec4",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mbqz8.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mbqz8.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6317c8a5-3595-4afc-a020-626888e4480b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mc2saintbarth-it.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mc2saintbarth-it.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3ab0277b-94ce-4a07-8973-3c3cdcc90cc0",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mc2saintbarth.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mc2saintbarth.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--45ae6400-8d8a-4b51-ad61-6d0a73eedc4c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mc515.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mc515.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0cdf9cfb-c083-458d-a8c7-e046c7f641e6",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mchny.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mchny.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--748db6fb-ec92-48d2-ab43-6e5034b56a63",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mcy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mcy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2c9222fe-7d05-471e-b0cd-884aee617e5b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: md814.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'md814.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2b70707e-ef9d-4d90-b3c1-2053c1b916fc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mechacortex.bond",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mechacortex.bond']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-bond",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2d2e285e-a0dc-45b1-adc6-e227a68ce20e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: medianacademicstatute37.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'medianacademicstatute37.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b0bbd43-eeb1-45d9-bf10-e796644dcf74",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mediaplay.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mediaplay.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4be2d2f0-1f12-4d97-86d6-b687aa6cacba",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: medic-an.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'medic-an.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--eb076f29-4c2b-4d47-b377-9f44ce4967a3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: medic-store.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'medic-store.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c6f1e442-a8b6-43fc-a1d3-2139a7f7276f",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: medix4.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'medix4.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3bafe0f1-3d55-4bec-9ede-01b78361f85d",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: medlix.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'medlix.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--03640917-5f6a-4501-b487-00abc1733ab9",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mega-giris-adress8.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mega-giris-adress8.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--79038e36-2bbf-47e7-a002-b4282eea8da1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mega-thrill-zone.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mega-thrill-zone.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bda61a30-9e06-4aaa-a9d7-923700bd9a97",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mega288jp71jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mega288jp71jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc3dcf43-b2ee-4fff-88fd-388f4f6b9368",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mega288jp72jt.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mega288jp72jt.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--a6dcf51c-27dc-4af4-b69b-dd1d3738f81b",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaanhubset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaanhubset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5807e2b0-1646-4971-8800-54798d6f0eca",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaanlabapp.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaanlabapp.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b05c3f0d-3c50-431b-9d4e-ea813eaa4f23",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaanlabbox.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaanlabbox.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--f9fc6f47-8ff3-40ca-8a74-cf45b16563b2",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megabwnpe.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megabwnpe.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1cf3c0f9-71d2-41a1-8481-0b4aec2dd18c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megabwnpeai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megabwnpeai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0e754a76-fe98-4b81-a2d0-3c913e7ac01c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megabwnpeway.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megabwnpeway.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--04a78cd3-b265-47d9-9326-edcd9986bc72",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megacityzone-luna.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megacityzone-luna.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--049ce871-a0fc-4db2-8943-ebb44bcbea13",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megacloudline-uty.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megacloudline-uty.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--988a2ff1-1c07-4554-b45c-526ac33bede7",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megacloudport-uty.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megacloudport-uty.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--55a770dd-c486-42c2-9970-78fcaaab84bb",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megakennedy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megakennedy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3c7d1f52-f610-4f8d-baf9-c98a3f4efd49",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megakwnplly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megakwnplly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bf459b6a-a2ac-4f4c-91ca-b648553ad489",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaleadbly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaleadbly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c3c8d6c0-1000-4fa0-9ce3-db4e3b88deaf",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megalionport-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megalionport-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--16b5d9a5-5548-44da-a6a5-6002598cc237",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: meganflowai.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'meganflowai.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--abf7cf86-44b1-4c43-87f1-64c31ed40fbc",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: meganflowify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'meganflowify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9b65321a-7c3f-4320-b3a6-e70ade85fd2c",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaorbitbase-uty.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaorbitbase-uty.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--23ca576c-1ece-47db-a6fa-75a74450e66a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megascaleset.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megascaleset.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5945cce2-aa80-4e03-8767-1cb4334c043e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaslot77oto.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaslot77oto.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0498bde7-8231-4ce2-9107-3364813f7392",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megasparkhub-byte.sbs",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megasparkhub-byte.sbs']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-sbs",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5ee3d7c1-cdcd-461c-8d42-08ccfdede668",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megaviralify.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megaviralify.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--bc52bc1c-da9f-4c68-8e9b-99068ac65ad3",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megawin88.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megawin88.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5d6c8f41-c76d-4f7c-a08b-513d7e303fff",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megawinku101x.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megawinku101x.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddc8b9f6-0dd0-42be-a874-90c8a1650334",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megawinku102x.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megawinku102x.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--89f1b65b-0f44-4801-99df-4da1da6ca9e1",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: megawsyncly.cyou",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'megawsyncly.cyou']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cyou",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--29753a20-3c99-450a-ad31-16f7936a874a",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: melbet-44n.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'melbet-44n.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3b8c9dbe-228e-42e6-8808-d4d13bb0dc38",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: melbet-cfjc.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'melbet-cfjc.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--cfef697a-9971-4567-b895-292aa898f933",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: melbet-n01.cfd",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'melbet-n01.cfd']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-cfd",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--874f8ff4-8ab8-464d-b03e-4a45b0835c23",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: melbet1366.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'melbet1366.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e70d1ec9-a4b1-4682-8a33-9e76dcfb2d64",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: melbet1713.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'melbet1713.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--e463cf0d-8bed-4683-99f3-22abd4d6c60e",
      "created": "2026-07-08T00:00:00.000Z",
      "modified": "2026-07-08T00:00:00.000Z",
      "created_by_ref": "identity--phishdestroy-shortdot",
      "name": "Phishing domain: mellstroyy.buzz",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'mellstroyy.buzz']",
      "pattern_type": "stix",
      "valid_from": "2026-07-08T00:00:00.000Z",
      "labels": [
        "phishing",
        "tld-buzz",
        "shortdot-zone"
      ]
    }
  ]
}